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SUBJECT:  Audit  Report  on  Section  8023  Certification  of  Automated  Information 
Systems  (Report  No.  96-008) 


We  are  providing  this  audit  report  for  review  and  comment.  We  considered 
management  comments  on  a  draft  of  diis  report  in  preparing  the  final  report. 

DoD  Directive  7650.3  requires  that  all  recommendations  be  resolved  promptly. 
Management  nonconcurred  with  the  recommendations.  As  a  result  of  comments  from 
the  U.S.  Transportation  Command,  we  deleted  draft  Recommendations  4. a.  and  4.b., 
which  related  to  its  Intransit  Visibility  System.  As  a  result  of  further  audit  analysis 
related  to  the  Defense  Logistics  Agency  automated  information  system,  we  deleted 
associated  draft  Recommendations  6. a.  and  6.b.  Also,  as  a  result  of  comments  from 
the  Under  Secretary  of  Defense  (Comptroller),  we  revised  Recommendations  l.b., 
2.b.,  3.b.,  and  4.b.  to  clarify  the  requirements  of  DoD  Directive  7200.1.  We  request 
that  the  Navy,  Air  Force,  Defense  Intelligence  Agency,  and  Washington  Headquarters 
Services  provide  comments  on  the  unresolved  recommendations  by  December  12, 
1995. 


Questions  on  the  audit  should  be  directed  to  Ms.  Mary  Lu  Ugone,  Audit 
Program  Director,  at  (703)  604-9529  (DSN  664-9529),  or  Ms.  Deborah  Carros,  Senior 
Auditor,  at  (703)  604-9539  (DSN  664-9539).  See  Appendix  E  for  the  report 
distribution.  The  audit  team  members  are  listed  inside  the  back  cover. 
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Section  8023  Certification  of  Automated  Information  Systems 


Executive  Summary 


Introduction.  Section  8023  of  Public  Law  103-139,  DoD  Appropriations  Act,  1994, 
requires  a  certification  process  for  automated  information  systems  that  are  expected  to 
exceed  a  $2  million  threshold  for  development  and  modernization  expenditures. 
Section  8023  requires  senior  functional  managers  to  certify  to  the  Assistant  Secretary  of 
Defense  (Command,  Control,  Communications,  and  Intelligence)  that  functional 
requirements  for  automated  formation  systems  are  valid  and  that  the  automated 
information  systems  do  not  unnecessarily  duplicate  other  available  or  planned 
automated  information  systems. 

Objectives.  The  primary  audit  objective  was  to  evaluate  the  implementation  of  the 
automated  information  system  certification  process  required  by  section  8023  of  Public 
Law  103-139.  We  did  not  review  the  management  control  program  applicable  to  the 
certification  process  because  the  provisions  of  section  8023  do  not  apply  beyond 
FY  1994. 

Audit  Results.  DoD  organizations  failed  to  perform  the  required  section  8023 
certification  process  for  nine  DoD  automated  information  systems  that  exceeded  the 
$2  million  threshold  for  development  and  modernization  costs.  As  a  result,  DoD 
exceeded  a^ropriated  funding  for  development  and  modernization  by  over 
$146  million  and  may  be  in  potential  violation  of  the  Antideficiency  Act  (see  Part  I). 

The  recommendations  in  the  report  will  ensure  DoD  either  complies  with  Public 
Law  103-139  or  reports  violations  of  the  Antideficiency  Act  according  to  DoD  policy. 
Appendix  C  summarizes  the  potential  benefits  of  the  audit. 

Summary  of  Recommendations.  We  recommend  that  senior  financial  managers 
within  the  Military  Departments  and  Defense  agencies  investigate  and  determine 
whether  Antideficiency  Act  violations  have  occurred  and  report  any  violations  in 
accordance  with  DoD  policy. 

Management  Comments.  The  Defense  Intelligence  Agency  nonconcurred  with  the 
recommendations,  stating  that  the  section  8023  certification  requirement  did  not  apply 
to  intelligence  systems.  The  Washington  Headquarters  Services  nonconcurred,  stating 
that  the  approval  process  followed  by  the  Major  Automated  Information  System 
Review  Council  for  FY  1994  expenditures  met  the  certification  requirement.  The 
Defense  Logistics  Agency  nonconcurred,  stating  that  the  certification  requirement  was 
met  on  the  basis  of  obtaining  Major  Automated  Information  Systems  Review  Council 


% 

DoD  expended  $152  million  for  the  development  and  modernization  of  three  of  the 
nine  automated  information  systems  (funding  data  for  the  six  Defense  Intelligence 
Agency  automated  information  systems  were  classified  and,  therefore,  are  not 
included).  Of  the  $152  million  for  the  three  systems,  $6  million  was  the  maximuTn 
allowable  development  and  modernization  expense  that  did  not  require  certification. 
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approval,  receiving  direction  from  the  Deputy  Under  Secretary  of  Defense  (Logistics), 
and  having  specific  congressional  authority  to  expend  funds  for  the  Automated 
Document  Conversion  System.  The  Navy  nonconcurred,  stating  that  it  followed 
guidance  from  the  Office  of  the  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence),  which  exempted  local  area  networks  from  the 
certification  requirement.  The  Air  Force  nonconcurred,  stating  that  its  automated 
information  system  was  exempt  from  certification  because  FY  1994  funding  was  used 
to  replace  broken  equipment  and  was  not  used  for  a  development  or  modernization 
effort.  The  U.S.  Transportation  Command  nonconcurred,  stating  that  it  had  not 
expended  more  than  $2  million  on  any  single  automated  information  system  within  the 
Intransit  Visibility  System  program.  Although  not  required  to  comment,  the  Under 
Secretary  of  Defense  (Comptroller)  and  the  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications,  and  Intelligence)  provided  comments.  The  Under  Secretary 
made  suggestions  to  clarify  information  in  die  finding  and  to  specify  the  guidance  in  the 
recommendations.  The  Assistant  Secretary,  in  essence,  nonconcurred  with  the  finding, 
stating  that  Congress  intended  for  the  scope  of  the  section  8023  requirement  to  apply 
only  to  programs  that  modernize  and  develop  certain  functional  software  applications. 
The  Assistant  Secretary  also  stated  the  Exhibit  43  reporting  guidance  was  used  to 
determine  the  scope  of  the  section  8023  certification  requirement  in  order  to  establish 
reasonable  and  practicable  parameters  and  baselines.  See  Part  I  for  details  on 
management  comments  and  Part  HI  for  the  complete  texts  of  the  comments. 

Audit  Response.  Section  8023  includes  a  provision  that  excludes  development  or 
modernization  of  automated  information  systems  that  were  previously  certified  by  the 
Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
as  fully  compliant  with  DoD  Directive  8000.1,  "Defense  Information  Management 
Program,"  October  27,  1992.  None  of  the  systems  discussed  in  the  finding  met  the 
exclusionary  provision.  Therefore,  managers  for  those  systems  needed  to  demonstrate 
that  functional  requirements  were  valid  and  that  system  development  or  modernization 
did  not  unnecessarily  duplicate  other  available  or  planned  automated  information 
systems.  As  a  result  of  U.S.  Transportation  Command  comments,  we  deleted  the  draft 
recommendations  related  to  its  Intransit  Visibility  System  program.  As  a  result  of 
additional  audit  analysis,  we  also  deleted  the  draft  recommendations  related  to  the 
Automated  Document  Conversion  System  of  the  Defense  Logistics  Agency.  The 
remainder  of  the  management  comments  claiming  exclusions  lacked  foundation.  We 
request  that  the  Defense  Intelligence  Agency,  Washington  Headquarters  Services,  the 
Navy,  and  the  Air  Force  reconsider  their  positions  and  provide  additional  comments  by 
December  12,  1995. 
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Audit  Results 


Audit  Background 


Section  8023  of  Public  Law  103-139,  DoD  Appropriations  Act,  1994 
(section  8023),  requires  that  Office  of  the  Secretary  of  Defense  (OSD)  principal 
staff  assistants  provide  certain  assurances  for  automated  information  systems 
(AISs)  with  a  potential  to  exceed  a  $2  million  threshold  for  development  and 
modernization  expenditures.  Section  8023  specifically  requires  that  no  funds  in 
excess  of  $2  million  be  expended  for  modernization  or  development  of  DoD 
AISs,  unless  the  senior  OSD  official  with  functional  responsibility  for  the  ATS 
certifies  to  the  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  (ASD[C^I])  that  the  functional  requirements 
are  valid  and  do  not  unnecessarily  duplicate  other  available  or  planned  AISs. 
The  provisions  of  section  8023  are  not  applicable  beyond  FY  1994. 

On  December  8,  1993,  the  ASD(C^I)  issued  a  memorandxim  to  the  OSD 
principal  staff  assistants,  implementing  action  to  facilitate  the  section  8023 
certification  process.  The  memorandum  includes  a  list  of  AISs  expected  to  have 
FY  1994  development  and  modernization  funding  requirements  in  excess  of 
$2  million.  The  OSD  principal  staff  assistants  with  responsibility  for  the 
fenctions  supported  by  the  AISs  were  instructed  to  certify  that  the  functional 
requirements  were  valid  and  that  the  system  development  or  modernization  did 
not  unnecessarily  duplicate  other  available  or  planned  AISs.  The  memorandum 
states  that  as  certifications  are  made,  the  ASD(C^I)  will  inform  the  Military 
Departments  and  Defense  agencies  that  development  and  modernization  funds  in 
excess  of  $2  million  could  be  expended  and  that  development  and  modernization 
funds  in  excess  of  $2  million  should  not  be  provided  for  AISs  that  do  not  meet 
the  criteria  for  certification. 

Automated  Information  Systems.  DoD  Directive  8120.1,  "Life  Cycle 
Management  of  Automated  Mormation  Systems,"  January  14,  1993,  defines  an 
automated  information  system  as  "a  combination  of  computer  hardware  and 
computer  software,  data  and/or  telecommunications,  that  performs  functions 
such  as  collecting,  processing,  transmitting,  and  displaying  information. "  DoD 
Directive  8120. 1  does  not  apply  to  computer  resources  that  are  necessary  for  fee 
training,  maintenance,  research  and  development,  and  mission  performance  of 
weapon  systems. 

Development  and  Modernization  of  AISs.  DoD  Regulation  7000. 14-R, 
"Financial  Management  Regulation,"  volume  2B,  chapter  18,  May  1994, 
provides  requirements  applicable  to  budget  formulation  and  congressional 
justification  of  information  technology  programs.  DoD  Regulation  7000. 14-R, 
chapter  18,  applies  to  all  activities  related  to  DoD  information  technology  and 
encompasses  all  DoD  appropriation  accounts  and  fends. 

Chapter  18  defines  information  technology  development  and  modernization  as 
"any  change  or  modification  to  an  existing  AIS  which  results  in  improved 
capability  of  performance  of  fee  baseline  AIS."  Additionally,  chapter  18  states 
feat  development  and  modernization  includes  program  costs  for  new  AISs  feat 
are  planned  or  under  development,  changes  mandated  by  Congress  or  OSD,  and 
any  change  or  modification  to  an  existing  AIS  feat  is  intended  to  result  in  an 
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Audit  Results 


improved  capability  or  performance  of  the  AIS.  Changes  include  all 
modifications  to  existing  operational  software  (other  than  corrective  software 
maintenance),  the  acquisition  of  technologically  newer  Federal  information 
processing  equipment  to  replace  outdated  Federal  information  processing 
equipment,  and  die  expansion  of  existing  capabilities  to  new  users. 

Appropriations  for  Development  and  Modernization.  AIS  development  and 
modernization  may  be  funded  by  multiple  types  of  funds.  Costs  for  the 
development  and  modernization  of  AISs  are  the  associated  program  costs,  which 
directly  relate  to  the  design,  development,  and  deployment  of  the  AIS.  As  a 
result,  development  and  modernization  costs  may  be  funded  using  Research  and 
Development,  Operation  and  Maintenance,  and  Procurement  funds.  Defense 
Business  Operations  Fund  capital  budget  authority  is  used  to  fund  the 
development  and  modernization  projects  of  organizations  funded  by  the  Defense 
Business  Operations  Fund. 


Audit  Objectives 


The  primary  audit  objective  was  to  evaluate  the  implementation  of  the  AIS 
certification  process  required  by  section  8023.  Specifically,  we  determined 
whether  AISs  that  fall  under  the  purview  of  section  8023  were  certified  and 
whether  certifications  met  the  intent  of  the  requirements  imposed  by 
section  8023.  We  did  not  review  the  management  controls  applicable  to  the 
implementation  of  the  certification  process  because  the  provisions  of 
section  8023  do  not  apply  beyond  FY  1994.  Appendix  A  discusses  the  audit 
scope  and  methodology  and  prior  audit  coverage. 
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Certifying  Development  and 
Modernization  Costs  of  Automated 
Information  Systems 

Nine  DoD  AISs  with  development  and  modernization  costs  that  exceeded 
the  $2  million  threshold  were  not  certified  in  accordance  with 
section  8023  because: 

0  the  ASD(C^I)  inappropriately  exempted  AISs  from 
certification  requirements  and  because 

0  the  Military  Departments  and  Defense  agencies  released 
development  and  modernization  funds  in  excess  of  $2  million  for  their 
AISs  that  had  not  been  certified. 

As  a  result,  DoD  exceeded  the  appropriated  funding  for  development 
and  modernization  by  a  total  of  $146  million^  for  three  of  the  nine  AISs 
that  were  not  certified  and  could  be  in  violation  of  the  Antideficiency 
Act. 


AIS  Certification  Requirements 


Congressional  Language  on  AISs  to  be  Certified.  Section  8023  of  Public 
Law  103-139  states: 

.  .  .  except  for  those  programs  to  modernize  and  develop  migration 
and  standard  automation  systems  that  have  been  certified  by  the 
Department's  senior  information  resource  management  (IRM)  official 
as  being  fully  compliant  with  the  Department's  information 
management  initiative  as  defined  in  Defense  Department  Directive 
8CXK).l,  no  funds  may  be  expended  for  modernization  or  development 
of  any  automated  information  system  by  the  military  departments, 
services,  defense  agencies,  Joint  Staff,  or  Military  Commands  in 
excess  of  $2,000,000  unless  the  senior  official  of  the  Office  of  the 
Secretary  of  Defense  with  primary  responsibility  for  the  functions 
being  supported  or  to  be  supported  certifies  to  the  Assistant  Secretary 
of  Defense  for  Command,  Control,  Communications  and  Intelligence 


iDoD  expended  $152  million  for  the  development  and  modernization  of  three  of 
the  nine  automated  information  systems  (funding  data  for  the  six  Defense 
Intelligence  Agency  automated  information  systems  were  classified  and, 
therefore,  are  not  included).  Of  the  $152  million  for  the  three  systems, 
$6  million  was  the  maximum  allowable  development  and  modernization  expense 
that  did  not  require  certification. 
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Certifying  Development  and  Modernization  Costs  of  Automated  Information 

Systems 


that  the  functional  requirement(s)  is  valid  and  that  the  system 
modernization  or  development  has  no  unnecessary  duplication  of  other 
available  or  planned  AISs. .  .  . 

The  provisions  in  DoD  Directive  8120.1  do  not  apply  to  AISs  related  to  weapon 
systems.  Also,  section  8023  excludes  from  the  certification  requirement  /5Ss 
that  have  been  previously  certified  by  the  ASD(C^I)  as  fully  compliant  ,  with 
DoD  Directive  8000.1,  "Defense  Information  Management  Program," 
October  27,  1992.  DoD  Directive  8000.1  establishes  policy  and  assigns 
responsibilities  for  implementation,  execution,  and  oversight  of  the  Defense 
Information  Management  program  to  include  functional  process  improvement, 
information  resources  management,  and  supporting  information  technology  and 
services  throughout  DoD. 

ASD(C^I)  Implementation  of  the  Certification  Process.  The 

December  8,  1993,  memorandum  issued  by  the  ASD(C^I)  includes  a 
certification  lisr  of  AISs  with  expected  FY  1994  development  and 
modernization  costs  in  excess  of  $2  million.  The  memorandum  acknowledges 
that  adjustments  to  the  certification  list  may  be  necessary  and  requests  that  the 
DoD  Components  review  the  certification  list  to  verify  that  it  reflected  all  AISs 
for  which  FY  1994  development  and  modernization  expenditures  would  exceed 
$2  million.  The  ASD(C^I)  memorandum  requested  that  the  DoD  Components 
identify  to  the  ASD(C^I)  or  to  the  appropriate  OSD  principal  staff  assistant  any 
additional  systems  that  required  certification  within  30  days  of  the  date  of  the 
memorandum.  The  ASD(C^I)  personnel  maintained  and  periodically  updated 
the  certification  list  and  indicated  accomplished  certiHcation  dates  and 
exclusionary  justifications. 

In  Januaiy  1995,  we  obtained  a  copy  of  the  most  current  (November  1994) 
certification  list  and  identified  22  uncertified  AISs.  We  prepared  an 
independent  certification  list  (audit  certification  list)  of  AISs  with  expected 
FY  1994  development  and  modernization  costs  of  $2  million  or  more.  From 
the  pdit  certification  list,  we  identified  an  additional  23  AISs  that  had  not  been 
certified.  The  ASD(C^I)  personnel  did  not  know  why  the  45  AISs  had  not  been 
certified  and  stated  that  the  DoD  Components  were  responsible  for  identifying 
additional  AISs  that  required  certification  to  the  OSD  principal  staff  assistants. 
See  Appendix  B  for  a  list  of  the  45  systems  we  reviewed  for  certification. 


^Personnel  from  the  Office  of  the  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications  and  Intelligence)  compiled  the  certification  list  using 
systems  found  on  the  Information  Technology  Budget  Exhibit  43s  and  on  the 
Major  Automated  Information  Systems  List,  which  is  compiled  by  the  same 
office. 
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Certifying  Development  and  Modernization  Costs  of  Automated  Information 
Systems 


ASD(C^I)  Exemptions  From  AIS  Certification  Requirements 


Information  Technology  Budget  Reporting  Requirements  Were  Used  to 
Define  Certification  Exemptions.  The  ASD(C^I)  limited  the  purview  of 
section  8023  to  AISs  for  which  the  DoD  Components  were  required  to  submit 
an  Information  Technology  Budget  Exhibit  43  (Exhibit  43),  even  though  that 
provision  was  not  specified  in  section  8023.  DoD  Components  use  Exhibit  43 
to  report  to  Congress  the  information  and  technology  development  and 
modernization  data  extracted  from  the  multiple  appropriations  and  funds  in  the 
DoD  budget.  DoD  Regulation  7000. 14-R,  chapter  18,  provides  guidance  for 
the  Exhibit  43  reporting  requirement  and  exempts  many  AISs,  such  as 
intelligence  and  command  and  control  AISs,  from  the  reporting  requirement. 
The  ASD(C^]0  personnel  told  the  auditors  that  the  section  8023  certification 
requirement  did  not  extend  to  those  AISs  that  were  exempt  from  the  Exhibit  43 
reporting  requirement.  The  ASD(C^I)  personnel  were  inconsistent,  however,  in 
applying  Exhibit  43  reporting  exemptions  to  the  certification  process. 
Intelligence-related  AISs  were  exempt  from  the  Exhibit  43  reporting 
requirement,  but  were  included  in  the  ASD(C^I)  assessment  of  systems  needing 
certification.  However,  none  of  the  six  intelligence  AISs  identified  for 
certification  had  been  certified.  In  addition,  a  major  AIS  that  did  not  appear  in 
the  Exhibit  43  report  was  excluded  from  the  certification  list  and,  therefore,  was 
not  certified  to  meet  requirements  of  section  8023. 

Uncertified  Intelligence  AISs.  Six  Defense  Intelligence  Agency  (DIA) 
AISs  exceeded  the  FY  1994  development  and  modernization  expenditure 
threshold  of  $2  million,  but  were  not  certified.  The  ASD(C^I)  personnel 
contacted  during  the  audit  did  not  know  why  the  systems  had  not  been  certified. 
The  DIA  personnel  stated  that  the  certification  requirement  was  overlooked  as  a 
result  of  the  ongoing  migration  system^  selection  process.  The  ASD(C^I) 
personnel  stated  ttiat  although  the  intelligence  AISs  should  have  been  certified, 
technically  no  requirement  existed  to  do  so  because  intelligence  systems  were 
exempt  from  the  Exhibit  43  reporting  requirement. 

Major  AIS  Not  Certified  Due  to  Exhibit  43  Exemption  Status. 
Washington  Headquarters  Services  did  not  certify  the  DoD  High  Performance 
Computing  Modernization  Program  (HPCMP)  which  is  contrary  to  section  8023 
requirements  and  expended  $146  million  on  development  and  modernization  in 
FY  1994.  The  HPCMP  is  a  major  AIS  stractured  to  modernize  the  total,  high- 
perfommnce,  computational  capability  of  DoD  research  and  development,  "nie 
A!®(C^I)  personnel  excluded  the  IffCMP  from  the  certification  requirement 
because  the  program  did  not  appear  in  the  FY  1994  Exhibit  43  report. 


^An  existing  or  planned  and  approved  automated  information  system  that  has 
been  designated  to  support  a  functional  process  on  a  DoD-wide  basis. 
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Local  Area  Networks  and  Hardware-Only  Development  and  Modernization 
Were  Exempted  From  the  Certification  Requirements.  The  Naval  Air 
Headquarters  Network  was  not  certified  as  required  and  had  FY 1994 
development  and  modernization  costs  in  excess  of  $2  million.  The  ASD(C^I) 
personnel  excluded  the  Naval  Air  Headquarters  Network  from  section  8023 
requirements  because  the  Naval  Air  Headquarters  Network  is  a  local  area 
network.  In  a  May  6,  1994,  memorandum,  the  Deputy  Assistant  Secretary  of 
Defense  (Information  Management)  stated  that  the  requirement  for  certification 
was  applicable  only  to  AISs  involved  in  the  development  or  modernization  of 
software.  Personnel  within  the  Office  of  the  Deputy  Assistant  Secretaiy  of 
Defense  (Information  Management)  stated  that  since  local  area  networks  do  not 
involve  software  development,  they  do  not  fall  within  the  scope  of  section  8023 
certification  requirements.  The  Naval  Air  Headquarters  Network  development 
and  modernization  effort  should  have  been  certified  by  the  senior  functional 
manager  (also  called  the  principal  staff  assistant)  because  DoD 
Regulation  7000. 14-R,  chapter  18,  does  not  restrict  hardware-only 
modifications  from  the  definition  of  development  and  modification. 


Releasing  Funds  for  Uncertified  AISs 


The  Command  Post  Upgrade  system  exceeded  the  FY  1994  $2  million 
development  and  modernization  ex^nditure  threshold  and  was  not  certified  by 
the  principal  staff  assistant,  which  is  contrary  to  the  section  8023  requirement. 
The  Air  Force  stated  that  it  used  an  incomplete  draft  Exhibit  43,  which  did  not 
indicate  that  the  Command  Post  Upgrade  would  require  section  8023 
certification.  The  Command  Post  Upgrade  system  was,  therefore,  never 
certified. 


Potential  Violations  of  Statutory  Restrictions 


Section  8023  establishes  a  statutory  restriction  on  the  expenditure  of  funds  in 
excess  of  $2  million  for  the  development  and  modernization  of  AISs.  That 
limitation  applied  to  funds  appropriated  by  the  DoD  Appropriations  Act,  1994, 
and  required  the  OSD  principal  staff  assistants  with  responsibility  for  the 
functions  supported  by  the  AISs  to  certify,  before  funds  could  be  expended,  that 
the  functional  requirements  were  valid  and  that  the  system  development  or 
modernization  did  not  unnecessarily  duplicate  other  available  or  planned  AISs. 
Failure  to  obtain  the  required  certification  for  programs,  before  exceeding  the 
$2  million  threshold,  resulted  in  improper  expenditures.  An  obligation  or 
expenditure  of  funds  that  exceeds  the  amount  available  in  an  appropriation  may 
constitute  a  violation  of  United  States  Code,  title  31,  section  1341(a),  a 
provision  of  the  Antideficiency  Act. 
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DoD  Directive  7200.1,  "Administrative  Control  of  Appropriations,"  May  4, 
1995,  provides  policy  and  issues  responsibilities  for  reporting  and  coordinating 
an  Antideficiency  Act  violation.  The  Directive  requires  that  the  head  of  the 
DoD  Components  investigate  potential  violations  of  the  Act  and  prepare  reports 
of  investigations. 


Conclusion 


DoD  is  not  in  compliance  with  section  8023  because  ASD(C^I)  personnel 
inappropriately  excluded  AISs  from  the  certification  requirements.  In  addition, 
the  Militaiy  Departments  and  Defense  agencies  released  development  and 
modernization  funds  in  excess  of  $2  million  for  AISs  that  had  not  been  certified. 

Of  45  DoD  AISs  identified  by  the  audit,  expenditures  for  9  AISs  exceeded  the 
FY  1994  $2  million  development  and  modernization  threshold  and  had  not  been 
certified.  DoD  exceeded  the  appropriated  funding  for  development  and 
modernization  by  $146  million  for  three  of  the  nine  AISs  that  were  not 
certified.  Because  $146  million  was  spent  in  excess  of  the  statutory  restriction 
of  $2  million  for  each  system,  DoD  could  be  in  violation  of  the  Antideficiency 
Act. 

Corrective  action  will  ensure  either  DoD  compliance  with  Public  Law  103-139 
or  that  violations  of  the  law  will  be  reported  according  to  DoD  policy  (see 
Appendix  C). 


Management  Comments  on  the  Finding  and  Audit  Response 


Under  Secretary  of  Defense  (Comptroller)  Comments  on  the  Finding. 
Although  not  required  to  comment,  the  Under  Secretary  proposed  minor 
changes  to  the  background  and  finding  sections  of  the  report.  The  Under 
Secretary  suggested  that  the  Audit  Background  state  that  the  Defense  Business 
Operations  Fxmd  capital  budget  authority  is  used  to  fund  the  development  and 
modernization  projects  of  organizations  funded  by  the  Defense  Business 
Operations  Fund.  Also,  the  HPCMP  is  not  exempt  from  Exhibit  43  reporting, 
and  action  has  been  taken  to  have  the  system  included  in  the  Exhibit  43  report. 
In  addition,  the  Under  Secretary  stated  that  the  finding  referenced  a  canceled 
version  of  DoD  Directive  7200.1  and  that  the  current  version  is  dated  May  4, 
1995. 

Audit  Response.  We  expanded  the  Audit  Background  to  include  the  use  of 
Defense  Business  Operation  Fund  capital  budget  authority  as  a  means  of  funding 
development  and  modernization  projects.  Also,  we  modified  the  finding  to 
include  the  comments  on  the  HPCMP  and  to  reflect  the  cmrent  DoD  Directive 
7200.1. 
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Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  Comments  on  the  Finding.  Although  not  required  to  comment, 
the  Deputy  Assistant  Secretary  of  Defense  (Information  Management)  responded 
for  the  ASD(C^I).  The  Deputy  Assistant  Secretary  stated  that  in  addition  to 
exclusions  related  to  AISs  that  are  part  of  weapon  systems,  section  8023 
provides  other  exclusions  because  it  states: 

.  .  .  except  for  those  programs  to  modernize  and  develop  migration 
and  standard  automation  systems  that  have  been  certified  ...  as  being 
fully  compliant  with  the  Department's  information  management 
initiative  as  defined  in  Defense  Directive  8000.1 . 

That  provision  shows  that  Congress  intended  for  the  scope  of  section  8023 
certification  requirements  to  apply  only  to  programs  to  modernize  and  develop 
certain  functional  software  applications  that  have  not  been  certified  as  fully 
compliant  with  the  information  management  initiative  defined  in  DoD 
Directive  8000.1.  Further,  Congress  did  not  intend  for  hardware-only  (for 
example,  local  area  networks)  development  or  modernization  efforts  to  be 
subject  to  the  certification  requirements.  Additionally,  DoD  Directive  8000.1 
should  serve  as  the  key  guide  in  determining  the  intent  of  Congress  because  the 
Directive  is  referenced  in  section  8023  and  is  applicable  to  information 
management  resources  and  services  used  for  routine  administrative  and  business 
applications. 

The  Deputy  Assistant  Secretary  further  stated  that  the  scope  of  the  certification 
requirement  was  limited  to  AISs  included  in  the  Exhibit  43  reporting 
requirement  in  order  to  establish  reasonable  and  practical  baselines  for 
certifications  of  AISs.  Because  chapter  18  of  DoD  Regulation  7000. 14-R 
applies  to  Exhibit  43  submissions,  those  AISs  exempt  firom  chapter  18  were  also 
excluded  from  the  requirement  for  certification.  Therefore,  because  intelligence 
AISs  were  exempt  from  Exhibit  43  reporting,  they  were  also  appropriately 
excluded  from  the  certification  process.  For  the  full  text  of  the  Deputy 
Assistant  Secretary  comments,  see  Part  III. 

Audit  Response.  We  agree  that  section  8023  includes  a  provision  (provided  on 
page  4  of  the  report)  for  AIS  exclusions  to  the  certification  requirement. 
Section  8023  further  states  that  except  for  those  excluded  programs,  no  funds 
may  be  spent  for  the  modernization  or  development  of  any  AIS  with 
expenditures  in  excess  of  $2  million,  unless  the  OSD  senior  functional  manager 
certifies  that  the  functional  requirements  are  valid  and  that  system 
modernization  or  development  is  not  duplicative  of  other  available  or  planned 
AISs.  Modernization  or  development  of  an  AIS  includes  both  computer 
hardware  and  software.  Section  8023  does  not  limit  the  scope  of  the 
certification  requirement  to  computer  software. 

We  do  not  agree  that  DoD  Directive  8000.1  should  be  used  as  the  key  guide  in 
determining  congressional  intent,  but  do  agree  with  management's  perspective 
that  section  8023  was  intended  to  ensure  that  funds  would  be  spent  on  migration 
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and  standard  systems  rather  than  on  duplicative  legacy'*  systems.  Those 
migration  and  standard  systems  include  information  management  resources  and 
services  used  for  routine  administrative  and  business  applications  as  well  as  for 
command  and  control  and  intelligence  applications. 

Further,  section  8023  does  not  limit  the  certification  requirement  to  those  AISs 
that  are  required  to  be  included  in  Exhibit  43  reports.  Additionally,  AISs  that 
do  not  appear  in  Exhibit  43  reports  are  not  necessarily  exempt  from  the 
reporting  requirement.  For  example,  as  a  result  of  our  draft  report,  the  Office 
of  the  Under  Secretary  of  Defense  (Comptroller)  has  taken  action  to  include  the 
previously  omitted  HPCMP  into  the  Exhibit  43  reporting  requirement. 


Recommendations,  Management  Comments  and  Audit 
Response 


Deleted,  Renumbered,  and  Revised  Recommendations.  As  a  result  of  U.S. 
Transportation  Command  comments,  we  deleted  draft  Recommendations  4. a. 
and  4.b.  The  U.S.  Transportation  Command  used  FY  1994  development  and 
modernization  funding  for  the  Intransit  Visibility  System  program  to  fund 
several  AISs,  and  no  single  AIS  exceeded  the  $2  million  development  and 
modernization  tihreshold  in  FY  1994.  As  a  result  of  further  analysis  of  the 
congressional  requirements  for  the  Automated  Document  Conversion  System, 
we  deleted  draft  Recommendations  6.a.  and  6.b.  Our  analysis  determined  that 
Congress  did  not  intend  for  the  Automated  Document  Conversion  System  to  be 
subject  to  the  certification  requirements  of  Section  8023,  as  shown  in  the 
language  of  Conference  Report  No.  103-339.  We  renumbered 
Recommendations  5. a.  and  5.b.  as  Recommendations  4.a.  and  4.b., 
respectively.  Also,  as  a  result  of  comments  from  the  Under  Secretary  of 
Defense  (Comptroller),  we  revised  final  report  Recommendations  l.b.,  2.b., 
3.b.,  and  4.b.  to  specify  the  guidance  and  action  needed  if  an  Antideficiency 
Act  violation  has  occurred. 

1.  We  recommend  that  the  Director,  Defense  Intelligence  Agency: 

a.  Investigate  the  expenditure  of  funds  in  excess  of  the  statutory 
limitation  in  section  8023  of  Public  Law  103-139,  DoD  Appropriations 
Act,  1994;  direct  that  appropriate  accounting  adjustments  be  made,  if 
needed;  and  determine  whether  violations  of  the  Antideficiency  Act  have 
occurred  for  the  following  systems: 

o  Advanced  Imagery  Requirements  Exploitation  System  Life 
Extension  and  Requirements  Managements  Systems, 


^Automated  information  systems  that  are  candidates  for  phase-out,  upgrade,  or 
replacement,  usually  because  they  do  not  comply  with  data  standards  or  other 
standards. 
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0  Client  Server  Environment, 

o  Defense  Attach^  Worldwide  Network, 

o  DoD  Intelligence  Information  Systems  Dissemination, 

0  Human  Intelligence  Operation  Communications  Network, 


0  Joint  Worldwide  Intelligence  Communications  Network. 

b.  Report  violations  of  the  Antideficiency  Act;  review  the 
performance  of  responsible  ofHcials;  and  initiate  appropriate  actions  in 
accordance  with  DoD  Directive  7200.1,  "Administrative  Control  of 
Appropriations,"  May  4,  1995,  if  it  is  determined  that  an  AntideHciency 
Act  violation(s)  has  occurred. 

Defense  Intelligence  Agency  Comments.  The  DIA  nonconcurred  with  the 
draft  recommendations,  stating  that  DIA  complied  with  the  intent  of  the 
congressional  language  in  section  8023.  The  DIA  stated  that  the  certification 
requirement  imposed  by  section  8023  was  not  applicable  to  DIA  intelligence 
information  systems  because  they  are  exempt  from  Exhibit  43  reporting 
requirements.  Further,  even  if  intelligence  AISs  were  subject  to  the 
certification  requirement  of  section  8023,  noncompliance  with  section  8023 
would  not  constitute  a  violation  of  the  Antideficiency  Act.  The  expenditures  in 
question  would  be  improper  expenditures,  not  Antideficiency  Act  violations. 
Certifications  can  be  requested  for  the  intelligence  systems  if  the  requirements 
of  section  8023  apply. 

Audit  Response.  As  previously  discussed  in  the  finding  and  in  our  response  to 
management  comments  on  the  finding,  section  8023  does  not  limit  the  purview 
of  the  certification  requirement  to  AISs  for  which  the  DoD  Components  are 
required  to  submit  Exhibit  43s.  Section  8023  states  that  except  for  AISs  already 
certified  by  the  ASD(C^I)  as  fully  compliant  with  DoD  Directive  8000.1,  no 
funds  may  be  spent  in  excess  of  $2  million  on  the  development  or 
modernization  of  any  AIS,  unless  the  certification  requirements  for  that  AIS 
have  been  satisfied. 

DoD  Regulation  7000. 14-R,  volume  14,  establishes  procedures  for  the  DoD 
Components  to  use  in  identifying  violations  of  the  Antideficiency  Act. 
Chapter  14  states  that  violations  of  the  Antideficiency  Act  may  occur  when 
statutoiy  limitations  on  the  purposes  for  which  an  appropriation  may  be  used  are 
violated.  If  DIA  did  not  comply  with  section  8023  certification  requirements, 
an  investigation  would  determine  whether  an  Antideficiency  Act  violation  had 
occurred.  We  ask  that  management  reconsider  its  position  and  provide 
additional  comments  on  the  final  report. 
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2.  We  recommend  that  the  Director,  Washington  Headquarters  Services: 

a.  Investigate  the  expenditure  of  funds  in  excess  of  the  statutory 
limitation  in  section  8023  of  Public  Law  103-139,  DoD  Appropriations 
Act,  1994;  direct  that  appropriate  accounting  adjustments  be  made,  if 
needed;  and  determine  whether  violations  of  the  Antideficiency  Act  have 
occurred  for  the  High  Performance  Computing  Modernization  Program. 

b.  Report  violations  of  the  Antideficiency  Act;  review  the 
performance  of  responsible  officials;  and  initiate  appropriate  actions  in 
accordance  with  DoD  Directive  7200.1,  "Administrative  Control  of 
Appropriations,"  May  4,  1995,  if  it  is  determined  that  an  Antideficiency 
Act  violation(s)  has  occurred. 

Washington  Headquarters  Services  Comments.  Washington  Headquarters 
Services  nonconcurred  with  the  draft  recommendations,  stating  that  an 
investigation  is  not  warranted  to  determine  Antideficiency  Act  violations 
because  no  expenditures  were  made  in  excess  of  the  amounts  appropriated  for 
the  HPCMP.  Washington  Headquarters  Services  farther  stated  that  although  a 
formal  certification  document  was  not  obtained  for  the  program,  compliance 
with  section  8023  requirements  was  achieved  during  reviews  that  led  to  Ae 
approval  of  FY  1994  expenditures  by  the  Major  Automated  Information  System 
Review  Council. 

Audit  Response.  As  discussed  in  the  finding,  because  the  HPCMP  was  not 
certified  before  exceeding  a  $2  million  cost  threshold  for  development  and 
modernization,  expenditures  were  made  in  excess  of  statutory  limitations 
imposed  by  section  8023.  DoD  Regulation  7000. 14-R,  chapter  14,  states  that 
violations  of  statutory  limitations  on  the  purpose  for  which  an  appropriation 
may  be  used  may  constitute  a  violation  of  the  Antideficiency  Act. 

We  ask  that  management  reconsider  its  position  in  response  to  the  final  report 
and  provide  the  documentation  that  shows  the  Major  Automated  Information 
System  Review  Council  reviews  concluded  that  the  functional  requirements  for 
the  HPCMP  were  valid  and  that  the  development  or  modernization  effort  did 
not  unnecessarily  duplicate  other  available  or  planned  AISs. 

3.  We  recommend  that  the  Assistant  Secretary  of  the  Navy  (Financial 
Management  and  Comptroller): 

a.  Investigate  the  expenditure  of  funds  in  excess  of  the  statutory 
limitation  in  section  8023  of  Public  Law  103-139,  DoD  Appropriations  Act, 
1994;  direct  that  appropriate  accounting  adjustments  be  made,  if  needed; 
and  determine  whether  violations  of  the  Antideficiency  Act  have  occurred 
for  the  Naval  Headquarters  Network. 

b.  Report  violations  of  the  Antideficiency  Act;  review  the 
performance  of  responsible  officials;  and  initiate  appropriate  actions  in 
accordance  with  DoD  Directive  7200.1,  "Administrative  Control  of 
Appropriations,"  May  4,  1995,  if  it  is  determined  that  an  Antideficiency 
Act  violation(s)  has  occurred. 


12 


Certifying  Development  and  Modernization  Costs  of  Automated  Information 

Systems 


Navy  Comments.  The  Navy  nonconcurred  with  the  draft  recommendations, 
stating  that  the  Navy  acted  in  accordance  with  specific  guidance  from  the 
ASD(C^I)  that  exempted  local  area  networks  from  the  certification  requirement. 
The  Navy  stated  that  because  the  individuals  contributing  to  the  potential 
violation  were  at  the  DoD  as  well  as  the  Navy  level,  an  investigation  into 
whether  a  violation  occurred  should  be  conducted  at  the  DoD  level. 

Audit  Response.  As  previously  discussed  in  the  audit  response  to  ASD(C^I) 
comments  on  the  finding,  section  8023  does  not  limit  the  scope  of  the 
certification  requirement  to  only  programs  that  modernize  or  develop  certain 
functional  software  applications.  Except  for  section  8023  exclusions,  AIS 
modernization  and  development  efforts,  to  include  local  area  networks,  should 
have  been  certified. 

Additionally,  because  the  Navy  expended  the  funds,  we  believe  the 
recommendation  is  directed  to  the  appropriate  level  and  is  consistent  with  the 
requirements  of  DoD  Directive  7200.1.  We  ask  that  management  reconsider 
its  position  and  provide  additional  comments  on  the  final  report. 

4.  We  recommend  that  the  Assistant  Secretary  of  the  Air  Force  (Financial 
Management  and  Comptroller): 

a.  Investigate  the  expenditure  of  funds  in  excess  of  the  statutory 
limitation  in  section  8023  of  Public  Law  103-139,  DoD  Appropriations  Act; 
1994;  direct  that  appropriate  accounting  adjustments  be  made,  if  needed; 
and  determine  whetW  violations  of  the  Antideficiency  Act  have  occurred 
for  the  Command  Post  Upgrade. 

b.  Report  violations  of  the  Antideficiency  Act;  review  the 
performance  of  responsible  officials;  and  initiate  appropriate  actions  in 
accordance  with  DoD  Directive  7200.1,  "Administrative  Control  of 
Appropriations,"  May  4,  1995,  if  it  is  determined  that  an  Antideficiency 
Act  violation(s)  has  occurred. 

Air  Force  Comments.  The  Air  Force  nonconcurred  with  the  draft 
recommendations,  stating  that  according  to  guidance  from  the  ASD(C^I)  and 
the  definition  of  modernization  and  development  in  DoD  Regulation  7000. 14-R, 
the  Command  Post  Upgrade  was  properly  exempted  from  section  8023 
certification  requirements. 

The  Air  Force  stated  that  FY  1994  development  and  modernization  funding  for 
the  Command  Post  Upgrade  was  used  to  replace  logistically  unsupportable  AIS 
equipment.  Further,  DoD  Regulation  7000. 14-R  excludes  the  replacement  of 
broken  equipment  from  the  definition  of  development  and  modernization. 

Also,  the  Air  Force  stated  that  the  audit  report  used  the  definition  of  an  AIS  in 
DoD  Directive  8120.1,  which  is  a  much  broader  definition  of  an  AIS  and 
differs  from  the  definition  for  AIS  in  DoD  Regulation  7000. 14-R  and  DoD 
Directive  8000,1. 
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Certifying  Development  and  Modernization  Costs  of  Automated  Information 
Systems 


Audit  Response.  DoD  Regulation  7000. 14-R  excludes  the  replacement  of 
broken  equipment  from  the  definition  of  development  and  modernization,  but 
does  not  exclude  the  replacement  of  logistically  unsupportable  equipment. 
Broken  equipment  might  be  replaced  with  identical  equipment,  but  logistically 
unsupportable  equipment  is  replaced  with  different,  usually  newer  equipment. 
The  Conunand  Post  Upgrade  did  not  meet  the  criteria  for  the  broken  equipment 
exclusion.  Additionally,  the  definition  of  an  AIS  in  DoD  Directive  8120.1, 
DoD  Directive  8000.1,  and  DoD  Regulation  7000. 14-R  is  similar.  However, 
the  applicability  of  the  respective  provisions  to^Ss  differs.  For  example,  as 
stated  in  DoD  Directive  8000.1,  the  ASD(C^I)  can  exempt  command  and 
control  and  intelligence  AISs  from  the  provisions  of  DoD  Directive  8000.1, 
whereas  DoD  Directive  8120.1  does  not  allow  such  an  exemption.  Both 
Directives,  however,  exclude  weapon  system  AISs.  The  Command  Post 
Upgrade  was  not  exempt  from  Section  8023  requirements  and  should  have  been 
certified  prior  to  exceeding  the  FY 1994  $2  million  development  and 
modernization  threshold.  We  ask  that  management  reconsider  its  position  and 
provide  additional  comments  on  the  final  report. 
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Part  n  -  Additional  Information 


IS. 


Appendix  A. 


Scope  and  Methodology 


Scope 


The  audit  identified  45  uncertified  AISs  comprised  of  AISs  taken  from  the 
Exhibit  43s,  from  the  Major  Automated  Information  System  List,  and  from  the 
certification  list  prepared  by  ASD(C^I)  personnel.  For  each  of  Ae  45  systems, 
we  determined  whether  the  development  and  modernization  spending  threshold 
imposed  by  section  8023  had  been  breached,  and  if  so,  whether  the  OSD  senior 
functional  manager  had  properly  certified  the  system. 

Limitations  to  Audit  Scope.  DoD  nonmajor  AISs  exempt  from  Exhibit  43 
reporting  could  not  be  identified  and,  therefore,  were  not  audited. 

Audit  Period,  Standards,  and  Locations.  We  conducted  this  performance 
audit  from  January  through  May  1995  in  accordance  with  auditing  standards 
issued  by  the  Comptroller  General  of  the  United  States,  as  implemented  by  the 
Inspector  General,  DoD.  Appendix  D  lists  the  organizations  we  visited  or 
contacted. 

Classified  Fiscal  Information.  We  identified  actual  development  and 
modernization  costs  for  the  AISs  audited  because  the  certification  requirement 
applied  only  to  AISs  that  exceeded  an  established  fiscal  threshold.  The  DIA 
costs  were  classified,  however,  and  are  not  in  this  report.  References  to  DIA 
development  and  modernization  costs  were  made  only  in  relation  to  whether 
they  exceeded  the  threshold  established  by  section  8023. 


Methodology 


For  each  of  the  45  AISs,  we: 

0  identified  and  documented  the  FY 1994  development  and 
modernization  costs;  and 

o  validated  the  current  certification  status  with  the  DoD  Component 
sponsor  or  with  the  senior  functional  manager. 

We  identified  nine  AISs  that  exceeded  the  $2  million  development  and 
modernization  threshold  and  that  were  not  certified  in  accordance  with 
section  8023.  We  contacted  the  respective  DoD  Component  sponsors  to 
determine  whether  they  had  requested  certifications  for  the  nine  imcertified  AISs 
(no  system  remained  uncertified  as  a  result  of  a  denied  certification).  Details 
are  in  Part  I  of  the  report. 
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Appendix  A.  Scope  and  Methodology 


We  deteraiined  that  16  of  the  45  AISs  had  been  properly  certified,  19  systems 
did  not  require  certification  because  FY  1994  development  and  modernization 
costs  did  not  breach  the  $2  million  threshold,  and  1  system  did  not  require 
certification  because  of  additional  congressional  requirements. 

We  obtained  assistance  from  the  Office  of  General  Counsel,  Inspector  General, 
DoD,  regarding  provisions  and  applicability  of  the  Antideficiency  Act.  We  did 
not  use  computer-processed  data  or  statistical  sampling  procedures  to  evaluate 
the  implementation  of  the  section  8023  certification  requirements. 


Prior  Audits  and  Other  Reviews 


No  prior  audits  have  been  performed  relating  to  the  implementation  of  the  AIS 
certification  process  required  by  section  8023. 
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Appendix  B.  Certification  Status  of  Automated 
Information  Systems 


Development  and 
Modernization 


Functional  Area  and 
Automated  Information  System 

Sponsor 

FY  1994  Amount 
(000) 

Acquisition 

Acquisition  Information 

Management^ 

Army 

$  1,824 

Material  Resources 

Department  of  the  Army  Movement 
Management  System-Redesign^*^ 

Army 

8,790 

Intransit  Visibility 

System 

USTRANSCOM-* 

2,262 

Airlift  Deployment  Analysis 

System 

Air  Force 

3,452 

Core  Automated  Maintenance 
System^*^ 

Air  Force 

6,297 

Integrated  Fuels  Management 

Systems^ 

DLA5 

-.6 

Depot  Level  Repairables 

Management  System^ 

JLSC’ 

58,563 

Medical  Core  Information 
Management  Wholesale 

System^ 

JLSC 

4,580 

Project  Management^ 

JLSC 

7,933 

Shop  Floor  Manufacturing^ 

JLSC 

9,838 

Specialized  Support^ 

JLSC 

13,923 

Supply  and  Technical 

JLSC 

30,600 

Data  Support  Migration^ 
See  footnotes  at  end  of  table. 


Certification  Status 

Not  required 

Certified 
Not  required 
Certified 

Certified 

Certified 

Certified 

Certified 

Certified 

Certified 

Certified 

Certified 
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Appendix  B.  Certiflcation  Status  of  Automated  Information  Systems 


Functional  Area  and 
Automated  Information  Svstem 

Soonsor 

Development  and 
Modernization 

FY  1994  Amount 

toooi 

Certification  Status 

Logistics  Material  Management 

Commodity  Command  Standard 
System^ 

Army 

$  133 

Not  required 

Automated  Document 

Conversion  System^’^ 

DLA 

13,944 

Not  Required 

Command  and  Control 

Kwajalein  Instrument  Control 
Center/Honolulu  Data 

Facility^ 

Army 

603 

Not  required 

Strategic  Command  and  Control 
Facility^ 

Army 

1,850 

Not  required 

Command  Post  Upgrade^ 

Air  Force 

2,729 

Uncertified 

Mobile  Command  and  Control 

System 

Air  Force 

1,950 

Not  required 

Satellite  Control  Facility 

Air  Force 

„8 

Certified 

Government  Emergency 
Telecommunications  System^ 

DISA 

0 

Not  required 

Planning  and  Decision 

Aid  System 

Joint  Staff 

-8 

Certified 

Information  Management 

Military  Entrance  Processing 
Command  Joint  Computer 

Center^ 

Army 

726 

Not  required 

Project  SOX  -  Phase  n 

Army 

1,453 

Not  required 

Naval  Air  Headquarters 

Network^ 

Navy 

4,499 

Uncertified 

See  footnotes  at  end  of  table. 
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Appendix  B.  Certification  Status  of  Automated  Information  Systems 


Functional  Area  and 
Automated  Information  System 

Sponsor 

Development  and 
Modernization 

FY  1994  Amount 

raool 

Certification  Status 

Intelligence 

Advanced  Imagery  Requirements 
Exploitation  System  Life  Extension/ 
Requirements  Management 
Systems^*^^ 

DIA 

$  -9 

Uncertified 

Client  Server  Environment^ 

DIA 

-9 

Uncertified 

Collection  Requirements 

Management  Application 

DIA 

.,9 

Not  required 

Defense  Attache  Worldwide 
NetworkLio 

DIA 

-.9 

Uncertified 

DoD  Intelligence  Information 

Systems  DisseminationLiO 

DIA 

Uncertified 

Human  Intelligence  Operation 
Communications  Network^ 

DIA 

..9 

Uncertified 

Joint  Worldwide  Intelligence 
Communications  Network^ 

DIA 

..9 

Uncertified 

Human  Resources 

Defense  Civilian  Personnel 

Data  System^® 

OSD 

7,000 

Certified 

Health 

Theater  Automated  Medical 
Management  Information 

System 

Army 

1,519 

Not  required 

Automated  Patient  Care 
Administration^ 

Health 

_.6 

Certified 

Military  Health  Care 

Management  Information 

System^® 

Health 

184 

Not  required 

See  footnotes  at  end  of  table. 
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Appendix  B.  Certiflcation  Status  of  Automated  Infoimation  Systems 


Functional  Area  and 
Automated  Information  Svstem 

Sponsor 

Development  and 
Modernization 

FY  1994  Amount 
fOOOl 

Certification  Status 

Health  (cont'd) 

National  (Uniform)  Claims 

Processing  System^® 

Health 

$  0 

Not  required 

Theater  Medical  Information 
System^*^ 

Health 

0 

Not  required 

Finance 

Interim  Naval  Air  Warfare 

Center  Financial  Support 

Navy 

955 

Not  required 

Property  Accountability 

System^ 

DFASll 

5,100 

Certified 

Teleservices^ 

DFAS 

1,978 

Not  required 

Research  and  Development 

TRADOC^^  Analysis  Command 
Computer^ 

Army 

0 

Not  required 

High  Performance  Computing 
Modernization  Program^ 

OSD 

143,600 

Uncertified 

Joint  Simulation  and 

Modeling 

Joint  Staff 

1,180 

Not  required 

Economic  Security 

Housing  Operations  Management 
System^ 

Army 

1,479 

Not  required 

Other 

Joint  Warfighting  Center^ 

Joint  Staff 

1,042 

Not  required 

^One  of  nine  uncertified  automated  information  systems  that  exceeded  the  $2  million 
toeshold  for  development  and  modernization  expendimres. 

^Identified  on  the  audit  certification  list. 

^Major  automated  information  system. 

'^U.S.  Transportation  Command. 

^Defense  Logistics  Agency. 

“System  and  related  program  costs  transitioned  to  certified  system. 

^ Joint  Logistics  Systems  Command. 

^Amount  not  available. 

^Classified  data. 

^^Selected  as  a  migratory  automated  information  system. 

^  ^Defense  Finance  and  Accounting  Service. 

^^raining  and  Doctrine  Command. 
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Appendix  C.  Summary  of  Potential  Benefits 
Resulting  From  Audit 


Recommendation 

Reference 


l.a.,  2. a.,  3. a., 
and  4. a. 


l.b.,2.b.,  3.b., 
and  4.b. 


Description  of  BeneHt 


Compliance  with  Public  Law. 
Determines  whether  violations  of 
the  Antideficiency  Act  have 
occurred. 

Compliance  with  Public  Law  and 
DoD  Regulation.  Provides  for 
reporting  potential  Antideficiency 
Act  violations  should 
Recommendations  l.a.,  2. a.,  3. a., 
and  4. a.  so  determine. 


Type  of  BeneHt 


Nonmonetary. 


Nonmonetary. 
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Appendix  D.  Organizations  Visited  or  Contacted 


Office  of  the  Secretary  of  Defense 


Under  Secretary  of  Defense  for  Acquisition  and  Technology,  Washington,  DC 
Under  Secretary  of  Defense  (Comptroller),  Washington,  DC 
Under  Secretary  of  Defense  for  Personnel  and  Readiness,  Washington,  DC 
Director,  Defense  Research  and  Engineering  (Program  Analysis  and  Integration), 
Washington,  DC 

Assistant  Secretary  of  Defense  (Command  Control,  Communications,  and  Intelligence), 
Washington,  DC 

Deputy  Assistant  Secretary  of  Defense  (Information  Management),  Washington,  DC 
Deputy  Assistant  Secretary  of  Defense  intelligence  and  Security),  Washington,  DC 
Deputy  Assistant  Secretary  of  Defense  (Plans  and  Resources),  Washington,  DC 
Deputy  Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence  Acquisition),  Washington,  DC 
Assistant  Secretary  of  Defense  (Health  Affairs),  Washington,  DC 
General  Counsel  of  the  Department  of  Defense,  Washington,  DC 
Director,  Civilian  Persoimel  Management  Service,  Falls  Church,  VA 
Director,  Civilian  Health  and  Medical  Programs  of  the  Uniformed  Services, 

Aurora,  CO 

Assistant  Deputy  Under  Secretary  of  Defense  (Logistics  Business  Systems  and 
Technolo^  Development),  Washington,  DC 


Joint  Staff 

Director,  Directorate  for  Operations,  Joint  Staff,  Washington,  DC 
Director,  Directorate  for  Command,  Control,  Communications  and  Computer  Systems, 
Joint  Staff,  Washington,  DC 

Director,  Directorate  for  Force  Structure,  Resources  and  Assessment,  Joint  Staff, 
Washington,  DC 


Department  of  the  Army 

Assistant  Secretary  of  the  Army  (Financial  Management),  Washin^on,  DC 
Director  of  Information  Systems  for  Command,  Control,  Communications  and 
Computers,  Washington,  DC 


Department  of  the  Navy 

Naval  Information  Systems  Management  Center,  Arlington  VA 
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Appendix  D.  Organizations  Visited  or  Contacted 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Acquisition),  Washington,  DC 
Deputy  Assistant  Secretary  of  the  Air  Force  (Budget),  Washington,  DC 


Unified  Command 

U.S.  Transportation  Command,  Scott  Air  Force  Base,  IL 


Other  Defense  Organizations 

Defense  Finance  and  Accounting  Service,  Arlington,  VA 
Defense  Intellijgence  Agency,  Washington,  DC 

National  Military  Intelligence  Systems  Center,  Washington,  DC 
Defense  Logistics  Agency,  Alexandria,  VA 
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Appendix  E.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
Assistant  to  the  Secretary  of  Defense  (Public  Affairs) 


Unified  Commands 

Commander  in  Chief,  U.S.  Transportation  Command 


Department  of  the  Army 

Auditor  General,  Department  of  the  Army 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Navy 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Air  Force 


Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Intelligence  Agency 
Director,  Defense  Logistics  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 
Director,  Washington  Headquarters  Services 
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Appendix  E.  Report  Distribution 


Non-Defense  Federal  Organizations  and  Individuals 

Office  of  Management  and  Budget 

Technical  Information  Center,  National  Security  and  International  Affairs  Division, 
General  Accounting  Office 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional 
committees  and  subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 

Senate  Committee  on  Armed  Services 

Senate  Committee  on  Governmental  Affairs 

Senate  Select  Committee  on  Intelligence 

House  Committee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committee  on  Appropriations 
House  Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal 
Justice,  Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 
House  Permanent  Select  Committee  on  Intelligence 
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Part  m  -  Management  Comments 


Under  Secretary  of  Defense  (Comptroller) 
Comments 


OFFICE  OF  THE  UNDER  SECRETARY  OF  DEFENSE 
1 100  DEFENSE  PENTAGON 
WASHINGTON.  DC  2030M  100 


( 


COMmiOLLCIt 


AUG  27  1996 


MEMORANDUM  FOR  DIRECTOR,  READINESS  AND  OPERATIONAL  SUPPORT 
DIRECTORATE,  DoD  IG 


SUBJECT:  Section  8023  CertiBcation  of  Automated  Information  Systems 
(Project  No.  4RE-5025.02) 


This  is  in  response  to  your  request  for  review  of  the  draft  subject  report  Comments  are 
attached  for  your  use.  My  staff  point  of  contact  is  Mr.  Chuck  Car^.  He  can  be  reached  on 
(703)  693-8342. 


Dqwty  Chief  Hnancial  Officer 


Attachment 


Under  Secretary  of  Defense  (Comptroller)  Comments 


Comments  on  DoD  10  Report  No.  4RE-5025.02,  Section  8023  Certification  of  Automated 

Information  Systems 

•  Page  3  of  the  Audit  Bacl^ground  section  states  that,  "...development  and  modernization  costs 
may  be  fimded  using  research  and  development,  operations  and  maintenance,  and 
procurement  funds."  DBOF-funded  oi^ganizations  use  Defense  Business  Operations  Fund 
(DBOF)  capital  budget  authority  to  fund  capital  investments,  i.e.,  development  and 
modernization  projects.  Iherefore,  this  section  of  the  draft  report  should  be  expanded  to 
include  this  fact 

•  The  bottom  of  page  8  makes  refer»ice  to  DoD  Directive  7200.1,  "Administrative  Control  of 
AK*n>priations,"  dated  May  7, 1984.  That  version  of  the  directive  has  been  canceled.  The 
current  version  is  dated  May  4, 1995. 

•  Recommendations  lb.-6b.  oa  pages  9-1 1  state,  'Tmplement  the  procedures  in 

DoD  Directive  7200.1,  "Administrative  Control  of  Appropriations,"  May  7, 1984,  to  report 
violations  of  the  Antideficiency  Act...  **  As  stated  above,  the  May  7, 1984,  version  of  this 
directive  has  bcea  canceled.  The  current  version,  dated  May  4. 1995,  does  not  include  the 
procedures  for  implementing  the  administrative  control  of  appropriations.  Those  procedures 
are  included  in  Volume  14,  "Administrative  Control  of  Appropriations,"  of  the  DoD 
Financial  Management  Regulation  (DoD  7(XX).  14-R).  Additionally,  the  recommendations 
should  direct  each  organization  to  follow  the  procedures  in  DoD  Directive  7200.1  rather 
than  "implement"  them.  The  use  of  the  term  "implement"  implies  that  each  organization  has 
yet  to  put  into  effea  the  requirements  of  the  directive.  This  is  not  the  case. 

•  Additionally,  recommendations  Ib.-tib.  state  furtiter, "...  and  initiate  iq^prqpriate  actions,  if 
accounting  adjustments  oc  the  inability  to  make  such  adjustments  result  in  a  violatioiL"  This 
segment  of  the  recommendation  should  be  revised  to  state  concisely  the  intended  purpose. 
Therefore,  it  is  recommend  that  the  following  statement  be  substituted, "...  and  initiate 
appropriate  actions  if  it  is  determined  that  an  Antideficiency  Act  violation(s)  has  occurred." 

•  The  statement  on  the  top  of  page  7  implies  the  DoD  High  Performance  Computing 
Modernization  Program  was  exempt  from  ExUbit  43  reporting.  The  DoD  Components  are 
to  report  any  information  technology  resource  If  it  meets  the  requirements  of  DoD 
Regulation  70(X).14-R,  Chapter  18.  Based  on  our  analysis  Exhibit  43  requirements  apply  and 
this  system  is  not  exempt.  Action  has  been  taken  to  have  the  system  included. 


Final  Report 
Reference 


Revised 
Page  3 


Revised 
Page  8 


Revised 
draft  Recom¬ 
mendations 
l.b.,2.b., 
and  3.b.; 
deleted  draft 
Recommen¬ 
dations  5. 
and  6.;  and 
revised  and 
renumbered 
Recommen¬ 
dation  4.b. 


Revised 
Page  6 
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Assistant  Secretary  of  Defense  (Command, 
Control,  Communications,  and  Intelligence) 
Comments 


Final  Report 
Reference 


Revised 
Page  5 


OFFICE  OF  THE  ASSISTANT  SECRETARY  OF  DEFENSE 

6CXX>  DEFENSE  PENTAGON 
WASHINGTON.  D.C.  20301 -SOOO 


31  1996 


COMMAND,  CONTMOC^ 
COMMUNICATION 
AMO  IMTCLUOKMCX 


MEMORANDUM  FOR  DIRECTOR,  READINESS  AND  OPERATIONAL  SUPPORT,  DODIG 

SUBJECT:  Audit  Report  On  Section  8023  Certification  of  Automated 

Information  Systems  (Project  No.  4RE-5025.02) 


In  reply  to  your  memorandum,  dated  June  28,  1995,  on  the 
above  subject,  we  have  reviewed  the  subject  draft  report  and 
offer  the  comments  below. 

We  defer  to  the  responsible  organizations  relative  to  a 
position  on  the  specific  recommendations  cited  in  the  report. 

The  comments  herein  address  (a)  the  degree  to  which  the  Section 
8023  certification  process  established  by  my  office  was 
consistent  with  the  intent  of  Congress,  and  (b)  whether  we 
inappropriately  exempted  automated  information  systems  from 
certification  requirements  as  indicated  in  the  report. 

DoD  16  rlndlngi  In  defining  AIS,  DoD  Directive (DoDD)  6120.1 
excludes  information  technology  related  to  weapon  systems. 

Section  8023  provides  no  provision  for  other  AIS  exclusions  to 
the  scope  of  the  certification  requirements. 

DASD(IM)  Comments  Partially  concur.  We  agree  that  DoDD 
8120.1  excludes  AISs  that  are  an  integral  part  of  a  weapon  or 
weapon  system,  test  support  for  a  weapon  or  weapon  system,  or 
basic  DoD  research  or  development  activities.  We  do  not  agree 
that  Section  8023  provides  no  other  exclusions.  Clearly,  Section 
8023  provides  for  exclusions  by  stating  ’‘ .  .  .  that  except  for 
those  programs  to  modernize  and  develop  migration  and  standard 
automation  systems  that  have  been  certified  ...  as  being  fully 
compliant  with  the  Department's  information  management  initiative 
as  defined  in  Defense  Department  Directive  8000.1,  ...* 

In  view  of  this  exclusion,  the  issue  is  one  of  determining 
the  intent  of  Congress  regarding  which  automated  information 
systems  (AISs)  should  have  been  subjected  to  the  Section  8023 
certification  process.  We  continue  to  believe  that  the  intent 
was  to  have  the  following  programs  certified: 

^Programs  to  modernize  and  develop  migration  and  standard 

automation  systems  [(e,g.,  functional  software 

applications)]  that  have  [NOT]  been  certified  ...  as  being 

o 
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Assistant  Secretary  of  Defense  (Conunand,  Control,  Conununications,  and 

Intelligence)  Conunents 


fully  compliant  vrith  the  Department's  information  management 

initiative  as  defined  in  DoD  Directive  8000.1,''  and 

^Programs  to  modernize  and  develop  'legacy'  systems  [(e.g., 

functional  software  applications)]" 

The  basis  for  our  position  is: 

•  The  definition  of  an  AIS  as  defined  in  DoDD  8000.1  which 
is  less  broad  in  scope  than  the  definition  in  DoD 
Directive  8120.1.  Other  than  the  language  itself,  we 
believe  that  DoDD  8000.1  should  serve  as  the  key  guide 
for  determining  the  intent  of  Congress  since  it  is 
referenced  in  the  language. 

•  The  applicability  of  DoD  Directive  8000.1  to 
resources  and  services  used  for  routine  administrative 

/  and  business  applications  ...* 

•  The  use  of  what  we  believe  to  be  a  key  phrase,  'migration 
and  standard  automation  systems,^  in  the  Section  8023 
language.  The  Department  has  had  a  long-standing 
practice  of  using  this  phrase  to  refer  to  'an  existing 
AIS,  or  planned  and  approved  AIS,  that  has  been 
officially  designated  as  the  single  AIS  to  support 
standard  processes  for  a  function.  Other  AISs,  called 
'legacy  systems,'  that  duplicate  the  support  services 
provided  by  the  migration  system  are  terminated,  so  that 
all  future  AIS  development  and  modernization  can  be 
applied  to  the  migration  system.*'  This  definition  is 
cited  in  the  Deputy  Secretary  of  Defense  memorandum  of 
October  13,  1993,  'Accelerated  Implementation  of 
Migration  Systems,  Data  Standards,  and  Functional  Process 
Improvement.^  Reference  to  the  ASD(C3I)  memoranda  of 
October  28,  1994  and  July  10,  1995  will  show  that 
virtually  all  of  the  selected  migration  systems  are 
functional  software  applications/systems . 

In  siunmary,  from  the  discussion  above,  we  believe  that  the 
Congress  intended  that  we  subject  certain  functional  software 
applications  to  certification.  It  was  not  intended  that 
hardware -oriented  acquisitions  be  addressed.  Consequently,  it 
was  entirely  appropriate  to  exclude  hardware  (e.g.,  local  area 
networks)  programs  from  the  Section  8023  certification  process. 


DoD  IG  Finding:  The  ASD<C3I)  limited  the  purview  of  Section  8023 
to  AISs  for  which  the  DoD  Components  were  required  to  submit  an 
Information  technology  Budget  Exhibit  43  (Exhibit  43),  even 
though  that  provision  was  not  specified  in  Section  8023. 
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DASD(IH)  Conmenti  Concur.  OASD<C3I)  did,  Indeed,  limit  the 
scope  of  the  Section  8023  process  to  AISs  that  were  included  in 
the  Information  Technology  Budget  Exhibit  43.  Similar  to  the  DoD 
IG  staff/  we  used  existing  DoD  regulations  and  guidance  in  an 
attempt  to  define  terms  used  in  Section  8023,  and  to  establish 
reasonable  and  practical  parameters  and  baselines.  For  example, 
in  its  evaluation  process,  the  DoD  IG  staff  referred  to  DoD 
Financial  Management  Regulation  7000. 14-R,  Chapter  18,  for  a 
definition  of  ’^modernization  and  development,*  and  recognizes 
AISs  such  as  intelligence,  and  command  and  control  systems  as 
being  exempt  from  Chapter  18  reporting  requirements.  The 
manifestations  of  Chapter  18  are  the  actual  Exhibit  43 
submissions  which  were  used  by  the  OASD(C3I)  staff  as  the 
baseline  for  Section  8023.  To  the  extent  that  AISs  were  exempt 
from  Chapter  18,  they  appropriately  would  not  appear  in  the 
Exhibit  43s,  and  consequently,  were  not  included  in  the  Section 
8023  certification  process. 

DoD  IG  Conclusloni  The  ASD(C3I)  inappropriately  exempted  AISs 
from  certification  requirements. 

DASD(IH)  Comments;  Nonconcur.  Prom  our  comments  above,  we 
continue  to  believe  that  hardware -oriented  acquisitions 
appropriately  should  have  been  exempted  from  the  certification 
process.  Moreover,  we  believe  that  intelligence  systems  should 
have  been  exempted. 

The  intelligence  systems  listed  in  the  report  are  funded 
within  the  National  Foreign  Intelligence  Program  which  is  under 
the  purview  of  the  Director  of  Central  Intelligence  (DCI).  Any 
management  decision  on  these  programs  requires  consultation  and 
coordination  with  the  DCI.  Moreover,  since  intelligence  systems 
are  exempt  from  Exhibit  43  reporting,  these  systems  were  not 
included  in  the  Section  8023  certification  process.  We  believe 
this  action  was  entirely  appropriate,  and  does  not  constitute  a 
violation  of  the  Antideficiency  Act. 

We  appreciate  the  opportunity  to  comment  on  the  draft 
report . 

C 

Cynthia  Kendall 

Deputy  Assistant  Secretary  of  Defense 
(Information  Management) 
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THE  ASSISTANT  SECRETARY  OF  THE  NAVY 
{FINANCIAL  MANAGEMENT  AND  COMPTROLLER) 
tOOO  NAVY  PENTAGON 
WASHINGTON.  D.C.  20380*1000 

2  8  AUG  1995 


MEMORANDUM  FOR  THE  DEPARTMENT  OF  DEFENSE  ASSISTANT  INSPECTOR 

GENERAL  FOR  AUDITING 

Subj:  DRAFT  REPORT  ON  THE  AUDIT  OF  SECTION  8023  CERTBFICATEON  OF 
AUTOMATED  INFORMATION  SYSTEMS  (PROJECT  NO.  4RE.5025.02)  - 
ACTION  MEMORANDUM 

Ref:  (a)  DODIGmemoof28  June  1995 

Enel:  (1)  DON  Response  to  Draft  Audit  Report 

I  am  responding  to  the  draft  audit  report  forwarded  by  reference  (a)  concerning 
certification  of  automated  information  systems  under  section  8023  of  Public  Law  103-139. 
The  Department  of  the  Navy  (DOl^  response  is  provided  at  enclosiue  (1). 

We  do  not  concur  with  the  draft  report  recommendations  which  affect  DON.  As 
outlined  in  die  enclosed  comments,  we  believe  that  an  investigation,  if  required,  should  be 
conducted  at  the  Department  of  Defense  level. 


DEBORAH  P.CHRISmE 


Copy  to: 

NAVINSGEN(02) 

Office  of  Financial  Operations  (FMO-31) 
ASN(RDA) 

NISMC 
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Department  of  the  Navy  Response 
to 

DODIG  Draft  Report  of  28  June  1995 
on 

Section  8023  Certification  of  Automated  Information  Systems 
Project  No.  4RE-5025.02 


Recommendation  3: 

We  recommend  that  the  Assistant  Secretary  of  the  Navy  (Financial  Management  and 
Comptroller): 

a.  Investigate  the  expenditure  of  fimds  in  excess  of  the  statutory  limitation  in  section 
8023  of  Public  Law  103-129,  DoD  Appropriations  Act,  1994;  direct  that  ^propriate 
accounting  adjustments  be  made,  if  needed;  and  determine  whether  violations  of  the 
Antideficiency  Act  have  occurred  for  the  Naval  Headquarters  Network. 

b.  Implement  the  procedures  in  DoD  Directive  7200.1,  ^Administrative  Control  of 
Appre^ations,**  May  7, 1984,  to  report  violations  of  the  Antideficiency  Act;  review  the 
p^ormance  of  responsible  oflScials;  and  initiate  appropriate  actions,  if  accounting 
adjustments  or  the  Inability  to  make  such  adjustments  result  in  a  violation. 


DON  Position: 

Do  not  concur.  The  Dq)artment  of  the  Navy  (DON)  acknowledges  that  costs  for 
development  and  modernization  of  the  Naval  Air  Headquarters  Network  (NHN)  exceeded 
$2  million.  However,  the  DON  acted  in  accordance  wi^  specific  guidance  firom  the 
Assistant  Secretary  of  Defense  (Command,  Control,  Communications  and  Intelligence) 
(ASD(C3I))  which  stated  that  die  certification  requirements  of  Section  8023  apply  only  to 
automated  information  systems  (AISs)  that  involve  the  development  or  modernization  of 
software. 

In  December  1993,  DON  identified  all  AISs  which  met  the  threshold  established  in  Section 
8023,  including  Local  Area  Networks  (LANs),  and  requested  assistance  of  the  Deputy 
Assistant  Secretary  of  Defense  (Information  Management)  (DASDOOM))  in  obtaining 
certification  by  the  responsible  senior  functional  managers,  or  Principal  Staff  Assistants 
(PSAs).  At  that  time,  funding  for  NHN  did  not  meet  the  $2  million  threshold,  so 
certification  was  not  requested  for  this  system.  Since  PSAs  were  responsible  for  certifying 
systems  within  their  functional  areas,  we  found  PSAs  reluctant  to  claim  primary 
responsibility  for  systems  which  supported  multiple  functions,  such  as  LANs.  In  January 


Enclosurs  (I) 
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1994,  DASD(IM)  agreed  to  certify  the  Naval  Sea  Systems  Command  (NAVSEA)  LAN, 
which  supports  all  lunctions  performed  under  the  mission  of  NAVSEA,  but  asked  DON  not 
to  submit  additional  LANs  for  certification.  They  advised  us  that  office  automation 
systems  such  as  LANs  were  outside  the  scope  of  Secion  8023  since  fiiey  consist  primarily 
of  hardware  and  involve  no  software  development.  Consequently,  when  funding  for  the 
i  NHN  exceeded  the  $2  million  tiireshold,  DON  did  not  seek  certification  under  Section 

8023. 

DASD(IM)  formalized  their  policy  in  May  1994  in  a  memo  which  stated  '^The  requirement 
for  certification  applies  only  to  automated  information  systems  that  involve  the 
development  or  modemizafion  of  software."  DON  had  no  reason  at  the  time  to  question  the 
le^timacy  of  this  policy.  Therefore,  althoug}!  DON  did  obligate  in  excess  of  $2  million  for 
NHN,  the  e3q)enditure  was  consistent  with  DoD  policy. 

If  the  ASD(C3I)  policy  was  in  error,  and  was  in  fact  contrary  to  Section  8023,  then  an 
investigation  shoiild  be  conducted  into  whether  or  not  a  violation  of  the  Antideficiency  Act 
occurred.  However,  since  the  individuals  involved  in  or  contributing  to  a  potential 
violation  are  at  the  DoD  as  well  as  tiie  DON  level,  it  would  be  appropriate  for  such  an 
investigation  to  be  conducted  at  the  DoD  level. 
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Final  Report 
Reference 


Page  7 


DEPARTMENT  OF  THE  AIR  FORCE 
WASHINGTON  DC 


AUG  1 1 1995 

OFFICE  OF  THE  ASSISTANT  SECRETARY 

MEMORANDUM  FOR  ASSISTANT  INSPECTOR  GENERAL  FOR  AUDITING 
OFFICE  OF  THE  INSPECTOR  GENERAL, 
DEPARTMENT  OF  DEFENSE 

FROM:  SAF/AQ 

1060  Air  Force  Pentagon 
Washington,  DC  20330-1060 

SUBJECT:  Section  8023,  Certification  of  Automated 

Information  System  Programs  (Project  No.  4RE-5025.02) 


In  r^ly  to  your  memorandum  requesting  the  Assistant  Secretaxy  of  the  Air  Force 
(Financial  M^gement  and  Comptroller)  to  provide  Air  Force  comments  on  subject 
report,  the  Air  Force  non-concurs  with  the  findings  concerning  the  Air  Force  Command 
Post  Upgrade.  (Uncertified  Air  Force-Sponsored  AIS  -  page  8). 

The  Air  Force  considered  and  properly  exempted  the  Command  Post  Upgrade 
(CPU)  firom  parting  under  the  Section  8023  c^fication  process.  This  determination 
was  niade  by  applying  guidance  presented  by  the  DoD  proponent  (ASD  C3I)  and  the 
definition  of  modernization  and  development  as  found  within  DoD  Financial 
Management  Regulations. 

Although  the  DoD  IG  Audit  Report  states  that  the  CPU  was  never  certified  due  to 
the  use  of  an  incomplete  draft  Exhibit  43,  we  maintain  that  this  is  incorrect.  While  the 
Air  Force  initially  used  the  November  1993  Exhibit  43  (working  draft),  we  also  instructed 
all  Air  Fmrce  coirunands,  agencies,  and  headquarters  fimctioxial  staffs  to  conduct  an  Air 
Force-wide  review  of  tiieir  Automated  Information  System  programs  to  ensure  we 
captured  all  which  met  the  provisions  of  the  section. 

The  Air  Force  Logistics  staff  determined  that  the  CPU  was  a  “basic  infi^structure 
upgrade**  based  on  the  requiring  command*s  description  in  their  FY94  Exhibit  43 
submission :  “This  system  provides  support  to  command  post  operations.  The  command 
post  is  modernizing  &e  unsecure  tel^hone,  mobile  radio  inter&ce,  and  hot  line 
operations  for  ACC  Command  Posts.**  According  to  the  DASD  C3I  (IM),  Section  8023 
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was  not  intended  to  require  certification  of  programs  which  did  not  involve  software 
development. 

The  Air  Force  Command,  Control,  Communications,  and  Computers  (C4)  staff 
excluded  the  program  by  {q)p]ication  of  an  exception  to  development  modernization 
found  in  DoD  Regulation  7000. 14-R:  ‘^...replacement  of  broken  FTP  to  continue 
operations  at  current  service  levels  is  not  considered  Dev/Mod.**  The  Air  Force  maintains 
^t  replacement  of  this  lo^stically  unsupportable  equipment  —  because  of  the  criticality 
of  the  mission  it  supported  —  was  rq>lacement  of  “broken**  equipment  Allowing 
logistically  unsupportable  equipment  to  fail  during  a  crisis  is  poor  management  at  best, 
and  in  time  of  war  or  contingency,  criminal  negligence. 

Finally,  we  note  that  the  CPU  did  not  appear  within  the  Air  Force  Exhibit  43 
database  until  the  final  report  was  published  in  March  1994.  By  that  time  CPU  had 
already  been  considered  and  discounted  as  rq)ortable  under  Section  8023,  as  had  many 
other  programs  reviewed  by  the  functional  staf&  and  major  commands. 

In  reviewing  our  systems  for  certification,  the  Air  Force  used  the  definitions  found 
in  the  DoD  Financial  Management  Regulation  in  effect  at  that  time.  We  would  like  to 
point  out  fiiat  the  definition  of  Automated  Information  Systems  (AIS)  as  used  by  the  DoD 
IG  team  —  fix)m  DoDI  8120.1-  is  different  firom  the  definition  established  by  both  the 
capstone  8000  series  directive  and  the  Federal  Financial  Management  Regulation.  Both 
DoD  Directive  8000. 1  and  the  version  of  DoD  R  7000. 14-R,  in  effect  at  the  time  of  this 
effort,  established  AIS  as:  “A  combination  of  information,  computer  and  telecommun¬ 
ications  ...  which  collects,  records,  processes,  stores  communicates,  retrieves,  and 
displays  information.**  However,  DoDI  8120.1  (as  used  by  the  DoD  IG)  allows  a  much 
broader  interpretation  of  applicability  by  changing  “and**  to  “andZor**  and  changing 
“which**  to  “that  performs  Actions  such  as**.  By  these  changes,  LANs  or  telephone 
systems  -  which  do  not  collect,  process  or  display  information  -  change  firom 
infirastmcture  support  systems  to  AIS. 

We  appreciate  your  consideration  of  the  Air  Force  coimnents  above  and  suggest 
reference  to  the  Command  Post  Upgrade  program  either  be  deleted  fix)m  the  final  report 
or  reflect  the  following,  more  accurate  description: 

Uncertified  Air  Force-Sponsored  AIS.  The  principal  staff  assistant  did  not 
review  the  Conunand  Post  Upgrade  system  in  accortoce  with  section  8023 
requirements.  The  Command  Post  Upgrade  system  was  properly  considered  and 
exempted  firom  certification  by  the  Air  Force;  however,  record  of  this 
determination  was  not  provided  to  the  principal  staff  assistant  for  review  because 
the  Air  Force  and  ASD  C3I  used  a  draft  Exhibit  43  to  determine  reporting  under 
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UNrrED  STATES  TRANSPORTATION  COMMAND 

■MtCOTTOII 

•COTT  Am  FORCC  BASE  It  uaaMir 


24  August  L995 


MEMDRANDOM  FOR  DC®  TNSPECVOR  GENERAL  (DIRECnOR,  READINESS  AND 
OPERATICNAL  SUPPORT  DIRECTORATE) 

FRCM:  TCDC 

SUBJECT:  Audit  Report  on  Section  8023  CJertification  of  Automated 
Information  S^tems  (Project  No.  4RE-5025.02) 

(Your  Memorandum,  28  JUn  95} 


1.  In  reply  to  referenced  memorandum,  we  nonconcur  with 
findings  oonceming  USTRANSCX3M*s  Intransit  Visibility  System  and 
have  provided  oorrments  (Atch  1) . 

2.  We  appreciate  the  opportunity  to  provide  input  to  the  draft 
report. 

3.  Our  POC  is  Mr.  Dwight  Moore,  TOJA,  DSN  576-2923. 


Lieutenant  General,  U.S.  Anry 
Deputy  Ctocnnander  in  Chief 


7U:tactnient : 
Management  Oonroents 


U.S.  Transportation  Conunand  Conunents 


Final  Report 
Reference 


Deleted 


Deleted 


Finding: 

Uncertified  U.S.  Transpoctatioa  CQinmand>Sp(niSQred  AIS.  Tbs  Intransit  \^ibility  System 
was  not  certified  by  the  r^^prqpriate  principal  st^  assistants  in  acooidance  with  sccticm  8023 
requirements.  FY 1994  de^opment  and  nKxkrnizafion  c?q)en(fiturcs  exceeded  $2  million. 
The  auditors  verified  the  Am^s  documented  request  &r  section  8023  ccrfificafion  fia*  the 
Intransit  Visibility  System,  but  the  ofBce  of  die  principal  staff  assistant  had  no  record  of  the 
request 

Response: 

Nonconcur.  Acccxdkg  to  die  draft  rqxxt,  Intiansit  Visibility  System  fir  FY  94  cost 
$2262  nuUion.  llie  <ftaft  iq)oct  indicates  the  system  was  not  ootified  aldiou^  it  exceeded 
die  $2  nulllon  threshold.  In  FY  1994,  $2262  million  was  budgeted  for  the  Intransit  A^ibilily 
Program  (ITV),  administered  by  Mlit^  TiafSc  Kfenagement  Cconmand  (hflMC),  a 
conponentofUSIRANSCDM  The  progtam  was  established  in  1989  as  a  result  of  a  tasking 
fiom  the  Dqnity  Secretary  of  De&nse  to  examine  the  feasibility  of  developing  a  woridwide 
intransit  cargo  visibility  system  using  existing  commercial  automated  systems  and  to  construct 
a  proto^pe  to  test  the  effectiveness  of  die  concept  The  FY  94  ftmds  for  the  ITV  program 
were  not  for  one  specific  system  as  contenqilated  by  Pub.  Law  103-139,  section  80(23.  That 
section  pcdiibits  esqienditure  of  fimds  in  excess  of  $2  million  on  ai^  automated  infonnation 
system  (AIS)  unless  certified  by  the  spodSicd  authority  as  currently  a  valid  requirement  with 
DO  tsmeoessary  diqilication  of  other  available  or  planned  systems.  The  ITV  program  did  not 
e^qiend  over  $2  million  on  any  one  AIS  during  1^  94.  lOCHDES  -  Integrated  Computerized 
D^loyment  System  ^130,708],  and  IBS  -  Integrated  Booking  System  [$629275]  received 
fin^g  with  94  nV  funds.  The  remainder  of  die  $2262M  was  ^lent  ftirriY  program 
cljectives  not  associated  vnih  lOODES  or  IBS.  Msconcepticm  was  partly  due  to  ITV  bring 
identified  in  USTRANSCOMs  budget  as  a  line  item;  however,  it  is  not  a  system  but  a  set  of 
infonnation  technology  initiatives  ^  provide  DoD  enhanced  ITV. 

Recommaidatioii: 

"We  recommend  diat  the  Gommander-in-Chie^  U.S.  Transpextation  Command: 

a  Investigate  die  eTqpenditure  of  funds  in  excess  of  the  statutory  limitation  in  section 
8023  of  Public  Law  103-139,  DoD  Appropriations  Act,  1994;  direct  di^  s^iprqsriate 
accounting  adjustments  be  n^de,  if  needed;  and  detenxiine  whether  violations  of  the 
Antideficiency  Act  have  occurred  for  the  Intransit  Visibility  System. 

b  Inplemcnt  die  procedures  in  DoD  Directive  7200.1,  "Adnunistrative  Control  of 
Appropriations,"  lAssy  7, 1984,  to  report  violations  of  the  Antideficiency  Act;  review  tiic 
perfixmance  of  responsible  officials;  and  initiate  i^prqxiate  actions,  if  accounting 
adjustments  or  die  inability  to  make  such  a^ustments  result  in  a  violatioa" 
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Response; 

Notxxxiciir.  Based  on  &e  infonnadon  provided,  tiiere  is  zx)  need  fcH^  a  formal 
invesdgatioii  as  there  has  been  no  violation  of  the  Antidedcienc^  Act  Aithou^  more  than 
$2  million  was  expeaded  for  the  PIV  program,  no  single  system  received  over  $2  million. 
Additionally,  the  intent  of  section  8023  was  to  ensure  no  funds  were  e?q)ended  on  systems  for 
winch  there  are  iiot  existing  requirements  or  viiichdi:^licate  other  systems.  HienV 
program  was  directed  by  Dqwty  SECDEF  to  reduce  transportation  costs  and  to  acquire 
automated  csp^iUties  providing  nV.  Every  dollar  speat  in  the  ITV  meets  the  intent  of 
section  8023. 
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DEFENSE  INTELLIGENCE  AGENCY 


WASHINGTON.  D.C.  20340. 


3  0  AUG  1995 


U-13,414/S-03A 


MEMORANDUM  FOR  INSPECTOR  GENERAL,  DEPARTMENT  OF  DEFENSE 

SUBJECT:  Audit  Report  on  Section  8023  -  Certification  of  Automated  Information  Systems  (AIS) 

References:  a.  DoDAG  memorandum,  subject:  Audit  Rq)Ort  on  Section  8023  Certification  of 
Automated  Information  Systems  (Project  No.  4RE-SQZ5.02),  28  Jun  95. 

b.  ASD(C3U  memorandum,  subject:  Development  or  Modernization  of  Automated 
Information  Systems  (AIS),  8  Dec  93. 

1.  Tbe  Defense  Intelligence  Agea^  (DIA)  nonconcurs  witii  tiie  draft  audit  rq>ort  findings  with 
respea  to  Intelligence  AISs  and  with  Recommendation  1  that  the  Director,  DIA,  investigate  ftmd 
.expenditures  for  the  systems  named  in  the  recommendation.  F6r  the  reasons  stated  in  paragraphs  2*4 
below,  DIA  believes  tiie  recommendations  are  not  relevant  to  DIA  and  should  be  deleted  entirely 
from  foe  rqx>rt. 

2.  DIA  has  coupled  with  foe  direction  issued  in  reference  b.  and  foe  Intent  of  foe  FY94  DoD 
Appropriations  Act  Section  8023.  Both  focus  on  diose  Information  management  (IM)  initiatives 
covered  in  Dq>artment  of  Defense  Directive  8000.1  tiiat  addresses  IM  resources  and  services  used  for 
routine  administrative  and  business  q^pllcations  that  also  may  be  used  In  conjunction  wlfo  certain 
ofoer  DoD  operational  activities,  indudlng  intelligeoce. 

—  Also,  DIA*s  intelligence  information  systems  activities  are  not  covered  In  DoD  Information 
Technology  Budget  Exhibit  43  reporting  based  on  foe  exclusions  stated  in  paragraph  180203J,  diapter 
18,  DoD  R^ulation  7000.14-R. 

3.  DIA  executed  no  FY94  funds  In  excess  of  $2  million  for  administrative  or  ofoer  business 
iqpplications  tiiat  it  considers  would  have  been  covered  by  tiie  Congressional  language  and  foe  related 
Instructions  in  reference  b. 

—  DIA  does  not  consider  that  the  funds  executed  for  foe  six  intelligence  information  systems 
projects  named  in  foe  draft  audit  npott  are  covered  by  either  Section  8023  and  related  reference  b. 
instructions. 


4.  Even  on  the  assumption  that  foe  certification  requirement  also  may  have  been  necessary  for 
Intelligeoce  systems  and  was  not  obtained,  DIA  does  not  agree  that  foe  expendhures  in  excess  of  $2 
million  on  eadi  system  would  constitute  a  violation  of  foe  Anti-Deficiency  Act 

a.  In  its  current  frmn,  foe  law  (foe  Anti-Deficiency  Act)  prohibits  "Making  or  authorizing  an 
expenditure  from,  or  creating  or  authorizing  an  obligation  under,  any  appropriation  or  fund  in  excess 
of  foe  amount  available  in  foe  appropriation  or  fund  unless  authorized  by  law...”  (General  Accounting 
Office  Principles  of  Federal  Appropriation  Law,  Second  Edition,  at  page  6-10).  In  this  case,  there  is 
no  assertion  by  any  party,  includiog  foe  DoD/IG,  that  an  expenditure  in  excess  of  an  appropriation 
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occuired.  Rather^  the  assertion  is  merely  tiiat  expenditures  widiin  appropriation  amounts  may  have 
been  made  in  violation  of  certain  conditions  set  by  Congress.  A  compaxible  situation  would  be  where 
expenditures  were  made  in  violatioa  of  the  Buy  America  Act  In  Soutfiem  Packing  and  Storage 
Company  vs  United  StatM.  588  F.  Supp.  532  (D.S.C.  1984),  the  court  rejected  the  contention  that  a 
violation  of  the  Buy  America  Act  also  constituted  a  violation  of  the  Anti-Deficiency  Act 

b.  Again,  assuming  diat  certifications  were  necessary  and  were  not  obtained,  the  expenditures  In 
question  would  be  inqiioper  expenditures  but  not  Anti-Deficiency  Act  violations. 


c.  From  DIA*s  perspective,  if  the  exclusion  granted  from  coverage  under  Section  8023  should 
now  be  deemed  to  be  improper,  die  necessary  certificafiona  can  be  requested.  To  fiie  extent  diat  the 
certificadODS  are  obtained,  die  expenditures  would  cease  to  be  unproper  and  no  frirther  corrective 
action  would  be  necessary. 

5.  If  the  DoD/IO  does  not  agree  DIA*s  recommendation  to  ddete  these  portions  from  the 
ttgo€t,  DIA  will  place  its  non-concurrence  in  die  final  report  along  the  lines  of  paragraphs  2-4  above. 


R.  CLAPPER/ JR. 
Lleutenanc  General,  USAP 
Director 
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DEFENSE  LOGISTICS  AGENCY 

HEADQUARTERt 
CAMERON  STATION 
ALEXANDRIA.  VIRGINIA  22304-6100 


30  19951 


MEMORANDUM  FOR  ASSISTANT  INSPECTOR  GENERAL  FOR  AUDITING, 
DEPARTMENT  OF  DEFENSE 

SUBJECT:  OIG  Draft  Report  No.  4RE-S025.02.  Section  8023  Certification  of 
Automated  information  Systems" 


This  is  in  response  to  your  June 


lEncI 


cc: 

FO  (Ann  McKewen) 
CA  (Thomas  Knapp) 


28, 1995  request 


/JACQMELINE  G.  BRYANT 
Chief,  Internal  Review  Office 
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Final  Report 
Reference 


TYPE  OF  REPORT:  AUDIT  PURPOSE  OF  INPUT:  INITIAL  POSITION 


AUDIT  TITLE  AND  NO.;  Draft  Report:  ^Section  8023  Certification  of  Automated  Information 
Systems,  *  (ProJectNo,  4RE^5025.02) 

RECOMMENDATION:  We  recommend  that  die  Director,  Defense  Logistics  Agency: 

ft.  Investigate  the  expenditure  of  funds  in  excess  of  the  statutory  limitation  in  section  8023  of 
Public  Law  103-139,  DoD  Appropriations  Act,  1994;  direct  that  appropriate  accounting  adjustments 
be  made,  if  needed;  and  determine  whether  violations  of  the  Antideficiency  Act  have  occurred  for 
the  Automated  Document  Conversion  System. 

b.  Implement  the  jxocedures  in  DoD  Directive  7200.1,  "Administrative  Control  of 
Appropriations,"  May  7, 1984,  to  report  violations  of  the  Antideficiency  Act;  review  the 
p^oimance  of  responsible  officials;  and  initiate  appropriate  actions,  if  accounting  adjustments  or 
the  inability  to  make  such  adjustments  result  in  a  violation. 

DLA  COMMENTS:  DLA  has  investigated  the  expenditure  of  funds  for  the  Automated  Document 
Conversion  System  and  non-concurs  for  the  following  reasons  that  a  potential  violation  of  the 
Antideficiency  Act  occurred: 

o  FY  94  Department  of  Defense  Appropriation  Act,  House  Report,  directed  DoD 
to  acquire  and  test  an  Automat^  Document  Conversion  System  (ADCS).  Public  Law  103-139 
specifically  appropriated  funds  to  DLA,  on  behalf  of  DoD,  to  acquire  and  test  the  system. 

o  DLA  and  Under  Secretary  of  Defense  (Logistics)  submitted  the  ADCS  program 
for  review  and  approval  by  the  Major  Automated  Information  Systems  Review  Council  (MAISRC), 
which  is  chaired  by  ASD  (C3I).  The  MAISRC  review  process  and  approval  of  the  ADCS  fiom 
initial  testing  to  d^loyment  satisfied  the  oversight  review  board  requirement  of  Section  8023. 

o  The  MAISRC  approved  continuing  with  the  program  and  delegated  oversight 
responsibility  to  Office  of  Secretary  of  Defense  (A&T). 

o  DUSD  (Logistics)  directed  continuance  of  the  test  and  obligations  of  the 

ADCS  funds. 

o  In  order  to  support  the  program,  the  operations  and  maintenance  funds  were 
rqprogrammed  to  Procurement,  Defense  Wide  funds.  This  reprogranuning  was  completed  at  the 
OSD  level,  with  full  knowledge  of  all  parties  and  signed  by  OSD(C). 

DLA  agrees  that  a  written  8023  certification  w^  not  completed,  but  DLA  complied  with  the 
certification  requirements.  The  specific  Congressional  authority  to  expend  funds  for  the  test,  the 


Deleted 


Deleted 
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MAISRC  approval  process  and  the  direction  of  DUSD  (Logistics)  satisfied  the  certification 
requirements. 


DISPOSITION: 

Action  is  considered  complete. 


ACTION  OFFICER:  W.A.  McEwen,  (703)  274-6226, 21  Aug  95 
REVIEW/APPROVAL:  J.D.  McCarthy,  CAPT,  SC,  USN,  Comptroller,  23  Aug  95 
COORDINATION:  Mr.  Tom  Knapp,  CAN 

E.  Sanchez,  FOE,  22  Aug  95 

L.  Coulter,  DDAI,  (703)  767-6261, 28  Aug  95 


DLA  APPROVAL: 


Major  General,  USA 
Principal  Deputy  Director 
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OFFICE  OF  THE  UNDER  SECRETARY  OF  DEFENSE 

3000  DEFENSE  PENTAGON 
WASHINGTON  DC  20301-3000 


18  AUG  1995 


MEMORANDUM  FOR  ASSISTANT  SECRETARY  OF  DEFENSE  (COMMAND,  CONTROL, 
COMMUNICATION  AND  INTELUGENCE) 


SUBJECT:  Autotnaied  Document  Conveision  System  (ADCS)  Section  8023  Certification 


Wc  do  not  feel  that  ADCS  should  be  included  in  the  Inspector  General’s  OG’s)  Audit 
Report,  Section  8023,  Certification  of  Automated  Information  Systems,  project  4RE-5025.02. 
Section  8023  states  that  no  fimds  may  be  obligated  for  the  Mquisidon  of  a  major  automated 
infoimation  system  until  the  system  has  completed  the  required  Department  of  Defense  oversight 
reviews  or  certified  by  their  functional  sponsor  that  they  are  non-dupUcative  of  other  development 
and  modernization  efforts. 

The  ADCS  was  specifically  funded  by  Congress  and  was  reviewed  and  approved  by  the 
Major  Automated  Information  Systems  Review  Council  (MAISRC).  The  MAISRC  reviews  were 
much  broader  in  scope  than  the  speciHc  Section  8023  requirements.  While  the  MAISRC  did  not 
specifically  include  the  duplication  assessment,  it  was  dcierniincd  by  this  office  that  ADCS  did  not 
duplicate  any  existing  or  developing  systems  prior  to  submission  to  the  MAISRC.  Based  on  the 
positive  outcome  of  these  reviews,  direction  was  provided  to  the  Defense  Logistics  Agency  on 
August  10. 1995  by  this  office  to  continue  with  the  test 

The  absence  of  a  specific  written  8023  certification  was  an  administrative  oversight.  Wc 
do  not  feel  that  ADCS  should  be  included  in  the  IG’s  Audit  Repon,  Section  8023.  Certification  of 
Automated  Information  Systems,  project  4RE-5025.02. 

KlE.  Beattie 

Assistant  Deputy  Under  Secretary 
of  Defense  (Logistics  Business  Sytems 
&  Technology) 


cc:  DUSDCL) 
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OFFICE  OF  THE  SECRETARY  OF  DEFENSE 
1950  DEFENSE  PENTAGON 
WASHINGTON.  DC  2030M950 


September  1, 1995 


MEMORANDUM  FOR  DIRECTOR,  READINESS  &  OPERATIONAL  SUPPORT.  DoD  IG 

Subject:  DoD  IG  Memorandum,  Audit  Report  on  Section  8023  Certification  of 

Automated  Information  Systems  (Project  4RE-5025.02),  dated  June  28, 1995 

1 .  Washington  Headquarters  Services  (WHS)  non-concurs  Avith  the  subject  draft  audit  report 
Recommendation  2  and  findings  with  respect  to  the  DoD  High  Performance  Computing 
Modernization  Program  (the  ''Program'*).  No  expendituies  have  been  made  in  excess  of 
amounts  appropiiatcxl  for  this  requirement  and  further  investigation  is  not  warranted  in  the 
context  of  the  Anti-deficiency  Act. 

2.  DoD  has  complied  with  the  intent  of  Section  8023  of  the  Defense  Appropriations  Act  of  1994 
with  respect  to  the  subject  Program.  This  program  clearly  met  the  criteria  for  the  certification  of 
section  8023  in  that:  1)  the  functional  requirements  were  valid,  and  2)  there  was  no  unnecessary 
duplication  of  other  available  or  planned  AIS's.  Compliance  with  these  criteria  was  surely 
conveyed  by  the  senior  official  responsible  for  this  program  and  understood  by  the  OASD  C3I 
during  the  course  of  the  extensive  system  justification  and  reviews,  including  the  reviews  which 
led  to  the  July  1994  MAISRC  approval  for  FY  1994  expenditures  for  the  program  by  the  OASD 
C3L  (see  attached) 

3.  To  the  extent  tiiat  a  specific  formal  written  form  is  not  in  hand  to  memorialize  certification  of 
the  underlying  requirements  of  Section  8023,  such  documentation  will  be  obtained  to  correct  any 
conlusio"  in  the  records  of  this  program  and  to  re-confirm  fiill  compliance  with  both  the  letter 
and  spirit  of  Section  8023. 


Thank  you  for  the  opportunity  to  comment  on  (his  matter. 

D.O.  Cooke, 
Director 


Attachment 
As  stated 


ADMINISTKATION  Sc 
MANAGEMENT 


Washington  Headquarters  Services  Conunents 


OFFICE  OF  THE  ASSISTAMT  BECREWV  OF  DEFENSE 
•OOODCFENSB  F«NT^21s« 

WASMNOTON,  0.e.  80*0l-«00 


u }  M  m 


HEUDRAMOOM  for  DIRSCTOR,  SETESSB  BSSBRRCB  WTO  EMCJHE8R1SC 

■RSJCCZ;  Funalng  In  Support  for  th»  BoD  High  Porfor»»ne« 
ModemiMtlon  Progran 


1  haro  r«vl«w*d  your  Ft  ** 

Sactad  lo  apprw  tha  taqueat,  becMoa 
Txvarall  »ode»lz^tlon  program  has  been  s3.ipped 
rSSr  dl.tii.5tiS  batweaa  tte  >!«* 
antS  the  estahliahaent  of  a  new  baiell&e  lor  the  program.  . 
SeaSe  X™ion  Officer,  Kfi.  Paa  Field,  apprised  of 

the  four  ooiM>etltive  aaqnliiltions  and  provide 
SSllL  fS  Se  ovSall  HPC  *o2en»laation  program  a. 
Konn  as  oiMalble  With  your  aaw  milestones  1&  hand  I  will 
b2?t^hr5hl5  ti  .chSula  tha  raguirad  review,  to  help 
axpedlte  your  program  goals. 


you  have  questiona  plaa8e,contac fc  me 


_  ^  _  Valletta 

AOti;<g’’ Chairman  MKISRC 


o 


49 


Audit  Team  Members 


This  report  was  prepared  by  the  Readiness  and  Operational  Support 
Directorate,  Office  of  the  Assistant  Inspector  General  for  Auditing,  DoD. 

Thomas  F.  Gimble 
Salvatore  F.  Guli 
Mary  Lu  Ugone 
James  Hutchinson 
Deborah  L.  Garros 
Nancy  C.  Cipolla 
Cristina  Maria  H.  Giusti 
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INTERNET  DOCUMENT  INFORMATION  FORM 


A .  Report  Title:  Section  8023  Certification  of  Automated  Information 
Systems 

B.  DATE  Report  Downloaded  From  the  Internet:  12/16/99 


C.  Report’s  Point  of  Contact:  (Name,  Organization,  Address,  Office 
Symbol,  &  Ph  #):  OAIG-AUD  (ATTN:  AFTS  Audit  Suggestions) 

Inspector  General,  Department  of  Defense 
400  Army  Navy  Drive  (Room  801) 

Ariington,  VA  22202-2884 


D.  Currently  Applicable  Classification  Level:  Unclassified 

E.  Distribution  Statement  A:  Approved  for  Public  Release 

F.  The  foregoing  information  was  compiled  and  provided  by: 

DTIC-OCA,  initials: _ VM _ Preparation  Date  12/16/99 


The  foregoing  information  should  exactiy  correspond  to  the  Titie,  Report  Number,  and  the  Date 
the  accompanying  report  document.  If  there  are  mismatches,  or  other  questions,  contact  the 
above  OCA  Representative  for  resolution. 


